Hello,

In this letter you will find the result of a brief security audit that we
did some time ago for HP-UX platform. We have found 8 vulnerabilities (seven
local and a remote one). Technical details about all of the vulnerabilities
were sent to the HP security team few months ago and in all cases appropriate
security patches are available.

For each vulnerability we have written a proof of concept code. Some of them
are available for download right now, the remaining ones will be published in
the near future (they are also available in special cases upon well justified
requests).

All proof of concept codes have been written for HP-UX 10.20 platform.

1. /usr/sbin/lanadmin
/usr/sbin/landiag

The vulnerability in the lanadmin and landiag programs is caused by improper
handling of the TERM environment variable in the setupterm() function - it
copies this variable without any size checking into the stack buffer with
the use of strcpy function. This bug can be triggered by invoking lanadmin
or landiag program with TERM environment variable set to a long string value.
When appropriately exploited it can lead to a local root compromise of
a vulnerable system.

2. /opt/sharedprint/bin/pcltotiff

There exists a buffer overflow vulnerability in the command line parsing
code portion of the pcltotiff program. This bug can be triggered by invoking
pcltotiff program with a long string argument passed with the -t command line
option. During program execution, this argument is further insecurely copied
into the stack buffer with the use of strcpy() function and without any size
checking. When appropriately exploited this bug can lead to privilege
elevation attack as group id of bin can be gained on a vulnerable system.

3. rpc.yppasswdd

The rpc.yppasswdd service is typically instaled with NIS (Network Information
Service) subsystem. The purpose of this service is to handle password change
requests from yppasswd program. In the HP-UX operating system, the
rpc.yppasswdd is installed as RPC service number 100009.

We have found that there exists the same security vulnerability in HP-UX
rpc.yppasswdd like in Solaris operating system (Bulletin Number #00209).
This vulnerability can be remotely exploited to gain unauthorised access to
the target HP-UX system with administrative (root user) privileges.

The vulnerability can be triggered by sending carefully crafted string
argument to the YPPASSWDPROC_UPDATE function. This function has two
arguments: a character string and a passwd struct (in our proof of concept
ode we only send a string instead of the whole structure), which stand for
respectively the oldpass and passwd struct (in our case pw_name string).
In the changepasswd() function the pw_name field of the passwd structure
is copied to a fixed buffer with the use of strcpy() function call. As this
call is done without any checking of the string length and boundaries,
program stack can be overwritten in a result of a buffer overflow condition.
Below you can see a detailed trace log from our bptrace tool, which clearly
illustrates the rpc.yppasswdd execution path that leads to the overflow
condition.

[21110] 0x00012a98 1 changepasswd()
[21110] 0x00025480 1 memset(0xffbefa30,0,40)
[21110] 0x00014448 1 xdr_yppasswd()
[21110] 0x00025738 1 xdr_wrapstring()
[21110] 0x00014374 1 xdr_passwd()
[21110] 0x00025744 1 xdr_uid_t()
[21110] 0x00025750 1 xdr_gid_t()
[21110] 0x000126b4 1 validstr()
[21110] 0x0002545c 1 strlen("")
[21110] 0x000255b8 1 strchr("",':')
[21110] 0x000126b4 2 validstr()
[21110] 0x000126b4 3 validstr()
[21110] 0x00025474 1 strcmp("udp","ticlts")
....
[21110] 0x00025438 1 strcpy(0xffbef9d8,"overlfow string with shellcode")

4. /usr/lib/X11/Xserver/ucode/screens/hp/rs.F3000

This vulnerability results from bad coding practices, specifically the
way system() function call is used throughout the code of rs.F30002 program.
This function call is used by rs.F30002 for invoking external programs
(like rm) without specifying their absolute path. If PATH environment
variable is appropriately set prior to such an unsafe system() call
invocation, user programs can be executed at elevated privileges
(user=daemon).

5. /usr/bin/stmkfont

Simple buffer overflow vulnerability exists in the command line parsing
code portion of the stmkfont program. This bug can be triggered by invoking
stmkfont program with a long string argument. When appropriately exploited
it can lead to privilege elevation attack as group id of bin can be gained
on a vulnerable system.

6. /usr/bin/uucp

The buffer overflow vulnerability exists in the command line parsing code
portion of the uucp program. This bug can be triggered by invoking uucp
program with a long string argument as option. When appropriately exploited
it can lead to the privilege elevation attack as user id of uucp can be
gained on a vulnerable system.

7. /usr/bin/uusub

The buffer overflow vulnerability exists in the command line parsing code
portion of the uusub program. This bug can be triggered by invoking uusub
program with a long string argument passed with -a command line option.
When appropriately exploited it can lead to the privilege elevation attack
as user id of uucp can can be gained on a vulnerable system.


Best Regards,
Members of LSD Research Group
<http://lsd-pl.net>