SecurityPortal

Solaris ftpd glob() Expansion LIST Heap Overflow Vulnerability
John McDonald of NAI's COVERT labs
http://securityfocus.com/templates/advisory.html?id=3202
http://www.cert.org/advisories/CA-2001-07.html#vendors
http://www.kb.cert.org/vuls/id/SVHN-4VN6DT
http://www.securityfocus.com/bid/2550

Sun and other UNIX/Linux/BSD Vendors have been caught by a serious hole in FTPD. All versions of Solaris are vulnerable to this remote root exploit (since ftpd normally runs as root). .

Description: The flaw occurs because the FTP servers incorrectly handle buffers that are related to the use of the glob() function. The glob() function, or filename "globbing," is the process of expanding short-hand notation into complete file names. On Solaris, the buffer overflow can be initiated by using the list command.
Exploit: non has been published for Solaris so far.
Workaround: Disable ftpd, or restrict access to certain IP addresses. Avoid anonymous ftp. Be especially wary of ftp servers that are on Internal or sensitive networks, but accessible from the Internet via a packet filter.
Solaris has a "stack execution" protection mechanism, it is unclear if enabling this in /etc/system helps (i.e. set noexec_user_stack=1 set noexec_user_stack_log=1). I tend to enable this on all Sun systems.
Fix: Sun have verified the problem, but a patch is not available yet and they have not issued a security bulletin either.
Aside: unfortunately, you can't rely on Sun's bulletins at all to keep you up-to-date on Solaris weakness and fixes.
More problems with FTPD globbing on Solaris have since been reported on Bugtraq:
http://archives.neohapsis.com/archives/bugtraq/2001-04/0181.html

NTP

Last week, we covered the announcement of a serious NTP vulnerability on Bugtraq email, there is now a bugtraq database entry. Most Linux vendors have released patches already, there is no indicate as to why Sun's NTP should not be vulnerable, not have Sun released any bulletins.
2001-04-04: Ntpd Remote Buffer Overflow Vulnerability
http://securityfocus.com/vdb/bottom.html?vid=2540

Recommendation: Replace Sun's NTPD with the latest freeware copy on any Sun NTP servers exposed to the Internet. The following version is an "intermediate release" a fully tested release should be available soon.
ftp://ftp.udel.edu/pub/ntp/ntp4/ntp-4.0.99k23.tar.gz

The eEye company have been busy poking for holes in Solaris:

Solaris kcms_configure vulnerability
eEye
http://www.eeye.com/html/Research/Advisories/solkcms.html

The problem exists in the parsing of command line options of the configuration tool for the Kodak Color Management System. By exploiting this vulnerability an attacker can achieve local root privileges.
Recommendation: disable the SUID bit, you don't need this tool anyway.
chmod ug-s /usr/openwin/bin/kcms_configure
Even better, as the kcms (Kodak Color Management System) is rarely use, either remove entirely or disable ALL SUID/SGID bits:
pkgrm SUNWkcspf SUNWkcspx SUNWkcspg SUNWkcsrt; chmod ug-s /usr/openwin/bin/kcms
Fix: no patch or bulletin has been announced by Sun.

Solaris Xsun buffer overflow vulnerability
eEye
http://www.eEye.com/html/Research/Advisories/solxsun.html

Exploiting a buffer overflow in Xsun, since it is SGID root, yields local root privileges. The overflow exists in Xsun's handling of the $HOME environment variable. Solaris 7 and 8 are confirmed to be vulnerable.
Recommendation: disable the SGID bit on servers if you don't need the GUI to run. On other systems, be vigilant until patches are announced.
Fix: no patch or bulletin has been announced by Sun.

Solaris ipcs buffer overflow vulnerability
eEye
http://www.eEye.com/html/Research/Advisories/solipcs.html

The ipcs tool used by Solaris 7 has a vulnerability that could allow an attacker to gain local sys group privileges on an affected system. Ipcs is a tool to report the status of inter-process communication facilities and the flaw lies in the parsing of the TZ (TIMEZONE) environment variable. An attacker could exploit this vulnerability by sending a buffer overflow to the utility and gain limited local privileges on the machine. Solaris 7 i386 is confirmed to be vulnerable. Exploitation is apparently difficult, but not impossible. Ipcs can be run to determine of IPC is in use on a particular system and hence is probably not essential to most systems.
Recommendation: Disable the SGID (chmod g-s /usr/bin/pics) bit for ipcs on hosts where inter-process communication is not needed (run ipcs first to see if IPC is operational). Even if IPC is needed, by removing the SGID bit, the IPC status can still be queried by root.
Fix: no patch or bulletin has been announced by Sun.

NOTE: It is recommended to remove a maximum of SUID and SGID bits on sensitive Solaris systems to minimise the exposure to local buffer overflow attacks, see the Tip of the Week section.

Weekly Solaris Security Digest
2001/04/08 to 2001/04/15

Rundown

Security Bulletins and Vulnerabilities

Security Bulletins

Solaris Vulnerabilities this Week

NTP

Vulnerabilities this Week — Third-party Applications:

Bugtraq database:

Patches

1. The latest Solaris "Recommended & Security Patch clusters" are as follows:

2. New or updated individual security/recommended patches.

News & Articles

BSD Today

Sun

Security Focus

SysAdmin Magazine

O'Reilly Network

SolarisGuide

Mailing Lists

Focus-Sun Discussions Threads

YASSP (the Solaris Hardening Tool) Developers' List Discussions

Security Tools

Tip of the Week: Whacking SUID (preventative hardening)

References and Resources

About the Author

Weekly Solaris Security Digest 2001/04/08 to 2001/04/15