Vulnerability

    man

Affected

    RedHat 7.0 with man-1.5h1-10 (default package) and earlier

Description

    zenith parsec found following.  Due to a slight error in a  length
    check, the -S  option to man  can cause a  buffer overflow on  the
    heap, allowing redirection of execution into user supplied code.

        man -S `perl -e 'print ":" x 100'`

    Will cause a seg fault if you are vulnerable.

    The info above to get man to seg fault is slightly incorrect.  You
    need to supply some text as the name of a man page - otherwise man
    will reject all input.  The  number of :'s is irrelevat too  - one
    is enough.

        man -S : blah

    will cause a seg fault.

    It is possible to  insert a pointer into  a linked list that  will
    allow overwriting  of any  value in  memory that  is followed by 4
    null characters (a null pointer).  One such memory location is the
    last entry on the GOT (global offset table).  When another item is
    added to the linked list, the address of the data (a filename)  is
    inserted over the last value, effectively redefining the  function
    to the code represented by the filename.

    Putting shellcode  in the  filename allows  execution of arbitrary
    code when the function referred to is called.

Solution

    This doesn't work on Slackware 7.1.

    For RedHat:

        ftp://updates.redhat.com/5.2/en/os/SRPMS/man-1.5i-0.5x.1.src.rpm
        ftp://updates.redhat.com/5.2/en/os/alpha/man-1.5i-0.5x.1.alpha.rpm
        ftp://updates.redhat.com/5.2/en/os/i386/man-1.5i-0.5x.1.i386.rpm
        ftp://updates.redhat.com/5.2/en/os/sparc/man-1.5i-0.5x.1.sparc.rpm
        ftp://updates.redhat.com/6.2/en/os/SRPMS/man-1.5i-0.6x.1.src.rpm
        ftp://updates.redhat.com/6.2/en/os/alpha/man-1.5i-0.6x.1.alpha.rpm
        ftp://updates.redhat.com/6.2/en/os/i386/man-1.5i-0.6x.1.i386.rpm
        ftp://updates.redhat.com/6.2/en/os/sparc/man-1.5i-0.6x.1.sparc.rpm
        ftp://updates.redhat.com/7.0/en/os/SRPMS/man-1.5i-4.src.rpm
        ftp://updates.redhat.com/7.0/en/os/alpha/man-1.5i-4.alpha.rpm
        ftp://updates.redhat.com/7.0/en/os/i386/man-1.5i-4.i386.rpm

    This has been confirmed on debian 2.2 woody, and submitted a patch
    to fix it.  The new version is in unstable - ver 2.3.18-2.

    For SuSE:

        ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/man-2.3.10d69s-190.i386.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/man-2.3.10d69s-190.src.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/man-2.3.10d69s-194.i386.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/man-2.3.10d69s-194.src.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/man-2.3.10d69s-191.i386.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/man-2.3.10d69s-191.src.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/man-2.3.10d69s-191.i386.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/man-2.3.10d69s-191.src.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/man-2.3.10d69i-19.i386.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/man-2.3.10d69i-19.src.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/man-2.3.10-85.i386.rpm
        ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/man-2.3.10-85.src.rpm
        ftp://ftp.suse.com/pub/suse/sparc/update/7.1/a1/man-2.3.10d69s-182.sparc.rpm
        ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/man-2.3.10d69s-182.src.rpm
        ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/man-2.3.10d69s-182.sparc.rpm
        ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/man-2.3.10d69s-182.src.rpm
        ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/man-2.3.10d69s-194.alpha.rpm
        ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/man-2.3.10d69s-194.src.rpm
        ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/man-2.3.10d69s-191.alpha.rpm
        ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/man-2.3.10d69s-191.src.rpm
        ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/man-2.3.10d69s-190.alpha.rpm
        ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/man-2.3.10d69s-190.src.rpm
        ftp://ftp.suse.com/pub/suse/ppc/update/7.1/a1/man-2.3.10d69s-162.ppc.rpm
        ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/man-2.3.10d69s-162.src.rpm
        ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/man-2.3.10d69s-162.ppc.rpm
        ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/man-2.3.10d69s-162.src.rpm
        ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/man-2.3.10d69s-163.ppc.rpm
        ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/man-2.3.10d69s-163.src.rpm

    For Immunix OS:

        http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/man-1.5i-0.6x.1_StackGuard.i386.rpm
        http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/mktemp-1.5-2.1.6x_StackGuard.i386.rpm
        http://download.immunix.org/ImmunixOS/6.2/updates/SRPMS/man-1.5i-0.6x.1_StackGuard.src.rpm
        http://download.immunix.org/ImmunixOS/6.2/updates/SRPMS/mktemp-1.5-2.1.6x_StackGuard.src.rpm
        http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/man-1.5i-4_imnx.i386.rpm
        http://download.immunix.org/ImmunixOS/7.0/updates/SRPMS/man-1.5i-4_imnx.src.rpm