__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
Vulnerability in RaQ 4 Servers
[CERTŪ Advisory CA-2002-35]
December 12, 2002 20:00 GMT Number N-025
______________________________________________________________________________
PROBLEM: A remotely exploitable vulnerability has been discovered in Sun
Cobalt RaQ 4 Server Appliances running Sun's Security Hardening
Package (SHP).
PLATFORM: Sun Cobalt RaQ 4 Server Appliances
DAMAGE: Exploiting this vulnerability could allow a remote attacker to
execute arbitrary code with superuser privileges.
SOLUTION: Check with your vendor for patches or workarounds.
______________________________________________________________________________
VULNERABILITY The risk is HIGH. An exploit is publicly available and may be
ASSESSMENT: circulating. Sun confirms that a remote root exploit does
affect the Sun/Cobalt RaQ4 platform if the SHP (Security
Hardening Patch) patch was installed.
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/n-025.shtml
ORIGINAL BULLETIN: http://www.cert.org/advisories/CA-2002-35.html
PATCHES:
http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?doc=fsalert/49377
______________________________________________________________________________
[***** Start CERTŪ Advisory CA-2002-35 *****]
CERTŪ Advisory CA-2002-35 Vulnerability in RaQ 4 Servers
Original release date: December 11, 2002
Last revised: --
Source: CERT/CC
A complete revision history can be found at the end of this file.
Systems Affected
Sun Cobalt RaQ 4 Server Appliances with the Security Hardening Package installed
Overview
A remotely exploitable vulnerability has been discovered in Sun Cobalt RaQ 4 Server
Appliances running Sun's Security Hardening Package (SHP). Exploitation of this
vulnerability may allow remote attackers to execute arbitrary code with superuser
privileges.
I. Description
Cobalt RaQ 4 is a Sun Server Appliance. For background information on Cobalt RaQ 4,
please see the COBALT RaQ 4 User Manual. Sun provides a Security Hardening Package
(SHP) for Cobalt RaQ 4. Although the SHP is not installed by default, many users
choose to install it on their RaQ 4 servers. For background information on the SHP,
please see the SHP RaQ 4 User Guide.
A vulnerability in the SHP may allow a remote attacker to execute arbitrary code on a
Cobalt RaQ 4 Server Appliance. The vulnerability occurs in a cgi script that does not
properly filter input. Specifically, overflow.cgi does not adequately filter input
destined for the email variable. Because of this flaw, an attacker can use a POST
request to fill the email variable with arbitrary commands. The attacker can then call
overflow.cgi, which will allow the command the attacker filled the email variable with
to be executed with superuser privileges.
An exploit is publicly available and may be circulating.
Further information about this vulnerability may be found in VU#810921 in the CERT/CC
Vulnerability Notes Database.
II. Impact
A remote attacker may be able to execute arbitrary code on a Cobalt RaQ 4 Server
Appliance with the SHP installed.
III. Solution
Apply a patch from your vendor
Appendix A contains information provided by vendors for this advisory. As vendors
report new information to the CERT/CC, we will update this section and note the
changes in our revision history. If a particular vendor is not listed below, we have
not received their comments. Please contact your vendor directly.
Workarounds
Block access to the Cobalt RaQ 4 administrative httpd server (typically ports 81/TCP
and 444/TCP) at your network perimeter. Note that this will not protect vulnerable
hosts within your network perimeter. It is important to understand your network
configuration and service requirements before deciding what changes are appropriate.
Caveats
The patch supplied by Sun removes the SHP completely. If your operation requires the
use of the SHP, you may need to find a suitable alternative.
Appendix A. - Vendor Information
Sun Microsystems
Sun confirms that a remote root exploit does affect the Sun/Cobalt RaQ4 platform if
the SHP (Security Hardening Patch) patch was installed.
Sun has released a Sun Alert which describes how to remove the SHP patch:
http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?doc=fsalert/49377
The removal patch is available from:
http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-en-Security-2.0.1-SHP_REM.pkg
Appendix B. - References
CERT/CC Vulnerability Note: VU#810921 - http://www.kb.cert.org/vuls/id/810921
Sun SHP RaQ 4 User Guide -
http://www.sun.com/hardware/serverappliances/pdfs/support/RaQ_4_SHP_UG.pdf
COBALT RaQ 4 User Manual -
http://www.sun.com/hardware/serverappliances/pdfs/manuals/manual.raq4.pdf
--------------------------------------------------------------------------------
grazer@digit-labs.org publicly reported this vulnerability.
--------------------------------------------------------------------------------
Author: Ian A. Finlay.
--------------------------------------------------------------------------------
This document is available from: http://www.cert.org/advisories/CA-2002-35.html
--------------------------------------------------------------------------------
CERT/CC Contact Information
Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.
CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday
through Friday; they are on call for emergencies during other hours, on U.S. holidays,
and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by email. Our public PGP
key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more information.
Getting security information
CERT publications and other security information are available from our web site
http://www.cert.org/
To subscribe to the CERT mailing list for advisories and bulletins, send email to
majordomo@cert.org. Please include in the body of your message
subscribe cert-advisory
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and
Trademark Office.
--------------------------------------------------------------------------------
NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering
Institute is furnished on an "as is" basis. Carnegie Mellon University makes no
warranties of any kind, either expressed or implied as to any matter including, but
not limited to, warranty of fitness for a particular purpose or merchantability,
exclusivity or results obtained from use of the material. Carnegie Mellon University
does not make any warranty of any kind with respect to freedom from patent, trademark,
or copyright infringement.
--------------------------------------------------------------------------------
Conditions for use, disclaimers, and sponsorship information
Copyright 2002 Carnegie Mellon University.
Revision History
December 11, 2002: Initial release
[***** End CERTŪ Advisory CA-2002-35 *****]
_______________________________________________________________________________
CIAC wishes to acknowledge the contributions of CERT for the
information contained in this bulletin.
_______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
N-015: SGI IRIX lpd Daemon Vulnerabilities via sendmail and dns
N-016: Buffer Overrun in Microsoft Data Access Components (MDAC)
N-017: Cisco PIX Multiple Vulnerabilities
N-018: Microsoft Cumulative Patch for Internet Explorer
N-019: Samba Encrypted Password Buffer Overrun Vulnerability
N-020: Red Hat Multiple Vulnerabilities in KDE
N-021: Cumulative Patch for Internet Explorer
N-022: Red Hat Updated wget packages fix directory traversal bug
N-023: Vulnerability in CIFS/9000 Samba Server2 2
N-024: Buffer Overflow Vulnerability in Solaris X Window Font Service
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH
