|
|
| |
| The dtaction utility allows applications or shell scripts, which are otherwise not connected into the CDE development environment, to invoke action requests. The action called action_name is invoked with the action_arg provided on the command line. A single action_name is required; the user may provide any number of action_args. Whereas the buffer overflow is occurred when an action_arg has more than 1023 characters. |
| |
Credit:
The information has been provided by bknight.
|
| |
Vulnerable systems:
SunOS 5.8 (x86)
SunOS 5.6 (Sparc)
It is possible to confirm the buffer overflow vulnerability of action_arg in /usr/dt/bin/dtaction by following this procedure:
$ DISPLAY="127.0.0.1:0.0"
$ export DISPLAY
$ /usr/dt/bin/dtaction foo `perl -e 'print "A"x1023'`
Segmentation Fault
$ ls -l /usr/dt/bin/dtaction
-r-sr-sr-x 1 root sys 22496 Dec 2 1999 /usr/dt/bin/dtaction
$ uname -svrm
SunOS 5.8 Generic_108529-10 i86pc
Workaround:
If root suid or sys setgid permission is not needed, remove suid and setgid bits.
|
|
|
