TUCoPS :: SunOS/Solaris

TUCoPS :: SunOS/Solaris :: n-113.txt
Sun Buffer Overflow in LDAP Name Service (CIAC N-113)

__________________________________________________________

The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________

INFORMATION BULLETIN

Sun Buffer Overflow in LDAP Name Service
[Sun Alert ID: 52222]

July 2, 2003 21:00 GMT Number N-113
______________________________________________________________________________
PROBLEM: There is a buffer overflow in the "nss_ldap.so.1" library.
PLATFORM: Solaris 8 and 9
DAMAGE: n unprivileged local user may be able to gain unauthorized root
access.
SOLUTION: Apply workaround stated in Sun's Alert Notification.
______________________________________________________________________________
VULNERABILITY The risk is MEDIUM. A local account is required to exploit this
ASSESSMENT: vulnerability.
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/n-113.shtml
ORIGINAL BULLETIN:
http://www.sunsolve.sun.com/pub-cgi/retrieve.pl?doc=
fsalert%2F52222&zone_32=category%3Asecurity
______________________________________________________________________________

[***** Start Sun Alert ID: 52222 *****]

* Sun(sm) Alert Notification
* Sun Alert ID: 52222
* Synopsis: In Solaris 8 and Solaris 9 a Buffer Overflow in the LDAP Name Service
May Lead to Unauthorized Root Access
* Category: Security
* Product: Solaris
* BugIDs: 4830525
* Avoidance: Workaround
* State: Committed
* Date Released: 26-Mar-2003
* Date Closed:
* Date Modified:

1. Impact

On Solaris 8 and Solaris 9 systems with the LDAP name service enabled, an
unprivileged local user may be able to gain unauthorized root access due to a buffer
overflow in the "nss_ldap.so.1" library.

2. Contributing Factors

This issue can occur in the following releases:

SPARC Platform

* Solaris 8
* Solaris 9

x86 Platform

* Solaris 8
* Solaris 9

Note: Solaris 2.6 and Solaris 7 are not affected.

Solaris 2.5.1 will not be evaluated regarding the potential impact of the issue
described in this Sun Alert document.

Only Solaris 8 and Solaris 9 systems with the LDAP name service enabled in the
"/etc/nsswitch.conf" file for any of the following databases are affected by this
issue:

* bootparams
* ethers
* hosts
* ipnodes
* netgroup
* netmasks
* networks

The LDAP name service is enabled for a database if the "ldap" keyword is present in
the "/etc/nsswitch.conf" as shown for the "hosts", "networks", and "netgroup"
databases in the following example:

$ grep ldap /etc/nsswitch.conf
hosts: ldap dns [NOTFOUND=return] files
networks: ldap [NOTFOUND=return] files
netgroup: ldap

3. Symptoms

There are no predictable symptoms that would show the described issue has been
exploited to gain root privileges.

Solution Summary

4. Relief/Workaround

To work around the described issue, edit the "/etc/nsswitch.conf" file to not use
LDAP with the following databases (i.e. remove the "ldap" keyword for these database
entries):

* bootparams
* ethers
* hosts
* ipnodes
* netgroup
* netmasks
* networks

For example, edit the following line in "/etc/nsswitch.conf" from:

hosts: ldap dns [NOTFOUND=return] files
to

hosts: dns [NOTFOUND=return] files

Editing the "/etc/nsswitch.conf" file requires root access rights.

5. Resolution

A final resolution is pending completion.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun
Alert notification may contain information provided by third parties. The issues
described in this Sun Alert notification may or may not impact your system(s). Sun
makes no representations, warranties, or guarantees as to the information contained
herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE
THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE,
OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION
CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of your agreement
to purchase services from Sun, or, if you do not have such an agreement, the Sun.com
Terms of Use. This Sun Alert notification may only be used for the purposes
contemplated by these agreements.

[***** End Sun Alert ID: 52222 *****]

_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of Sun Microsystems, Inc. for the
information contained in this bulletin.
_______________________________________________________________________________

CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

N-103: Sun ONE Application Server May Disclose JavaServer Pages (JSP) Source
N-104: Red Hat Updated KDE packages
N-105: Sun "/usr/lib/utmp_update" Command Buffer Overflow Vulnerability
N-106: SGI Websetup/Webmin Security Vulnerability
N-107: PDF readers/viewers Malicious Hyperlinks Vulnerability
N-108: Sun's XSun Program Buffer Overflow Vulnerability
N-109: Microsoft Flaw in ISAPI Extension for Windows Media Services Could Cause Code Execution
N-110: Red Hat Updated XFree86 Packages Provide Security and Bug Fixes
N-111: Red Hat Updated unzip Packages Fix Trojan Vulnerability
N-112: Red Hat Updated PHP Packages Fix Bugs