|
Vulnerability man Affected RedHat 7.0 with man-1.5h1-10 (default package) and earlier Description zenith parsec found following. Due to a slight error in a length check, the -S option to man can cause a buffer overflow on the heap, allowing redirection of execution into user supplied code. man -S `perl -e 'print ":" x 100'` Will cause a seg fault if you are vulnerable. The info above to get man to seg fault is slightly incorrect. You need to supply some text as the name of a man page - otherwise man will reject all input. The number of :'s is irrelevat too - one is enough. man -S : blah will cause a seg fault. It is possible to insert a pointer into a linked list that will allow overwriting of any value in memory that is followed by 4 null characters (a null pointer). One such memory location is the last entry on the GOT (global offset table). When another item is added to the linked list, the address of the data (a filename) is inserted over the last value, effectively redefining the function to the code represented by the filename. Putting shellcode in the filename allows execution of arbitrary code when the function referred to is called. Solution This doesn't work on Slackware 7.1. For RedHat: ftp://updates.redhat.com/5.2/en/os/SRPMS/man-1.5i-0.5x.1.src.rpm ftp://updates.redhat.com/5.2/en/os/alpha/man-1.5i-0.5x.1.alpha.rpm ftp://updates.redhat.com/5.2/en/os/i386/man-1.5i-0.5x.1.i386.rpm ftp://updates.redhat.com/5.2/en/os/sparc/man-1.5i-0.5x.1.sparc.rpm ftp://updates.redhat.com/6.2/en/os/SRPMS/man-1.5i-0.6x.1.src.rpm ftp://updates.redhat.com/6.2/en/os/alpha/man-1.5i-0.6x.1.alpha.rpm ftp://updates.redhat.com/6.2/en/os/i386/man-1.5i-0.6x.1.i386.rpm ftp://updates.redhat.com/6.2/en/os/sparc/man-1.5i-0.6x.1.sparc.rpm ftp://updates.redhat.com/7.0/en/os/SRPMS/man-1.5i-4.src.rpm ftp://updates.redhat.com/7.0/en/os/alpha/man-1.5i-4.alpha.rpm ftp://updates.redhat.com/7.0/en/os/i386/man-1.5i-4.i386.rpm This has been confirmed on debian 2.2 woody, and submitted a patch to fix it. The new version is in unstable - ver 2.3.18-2. For SuSE: ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/man-2.3.10d69s-190.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/man-2.3.10d69s-190.src.rpm ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/man-2.3.10d69s-194.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/man-2.3.10d69s-194.src.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/man-2.3.10d69s-191.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/man-2.3.10d69s-191.src.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/man-2.3.10d69s-191.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/man-2.3.10d69s-191.src.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/man-2.3.10d69i-19.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/man-2.3.10d69i-19.src.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/man-2.3.10-85.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/man-2.3.10-85.src.rpm ftp://ftp.suse.com/pub/suse/sparc/update/7.1/a1/man-2.3.10d69s-182.sparc.rpm ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/man-2.3.10d69s-182.src.rpm ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/man-2.3.10d69s-182.sparc.rpm ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/man-2.3.10d69s-182.src.rpm ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/man-2.3.10d69s-194.alpha.rpm ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/man-2.3.10d69s-194.src.rpm ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/man-2.3.10d69s-191.alpha.rpm ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/man-2.3.10d69s-191.src.rpm ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/man-2.3.10d69s-190.alpha.rpm ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/man-2.3.10d69s-190.src.rpm ftp://ftp.suse.com/pub/suse/ppc/update/7.1/a1/man-2.3.10d69s-162.ppc.rpm ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/man-2.3.10d69s-162.src.rpm ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/man-2.3.10d69s-162.ppc.rpm ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/man-2.3.10d69s-162.src.rpm ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/man-2.3.10d69s-163.ppc.rpm ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/man-2.3.10d69s-163.src.rpm For Immunix OS: http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/man-1.5i-0.6x.1_StackGuard.i386.rpm http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/mktemp-1.5-2.1.6x_StackGuard.i386.rpm http://download.immunix.org/ImmunixOS/6.2/updates/SRPMS/man-1.5i-0.6x.1_StackGuard.src.rpm http://download.immunix.org/ImmunixOS/6.2/updates/SRPMS/mktemp-1.5-2.1.6x_StackGuard.src.rpm http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/man-1.5i-4_imnx.i386.rpm http://download.immunix.org/ImmunixOS/7.0/updates/SRPMS/man-1.5i-4_imnx.src.rpm