Risks
Vulnerabilities
Browse by
CDE dtprintinfo Help search buffer overflow vulnerability
30 April 2002
Bookmark and Share
eSO Security Advisory: 2406
Discovery Date: March 31, 2000
ID: eSO:2406
Title: CDE dtprintinfo Help search buffer overflow vulnerability
Impact: Local attackers can gain root level access
Affected Technology: Solaris 2.4, 2.5, 2.5.1, 2.6, 7, 8 SPARC and x86
HP-UX 10.10, 10.20, 10.24, 11.00, 11.04, 11.11
IBM AIX 4.3, 4.3.1, 4.3.2, 4.3.3
Compaq Tru64 5.1A, 5.1, 5.0A, 4.0G, 4.0F
CDE
Vendor Status: Patches are available
Discovered By: Kevin Kotas of the eSecurityOnline Research
and Development Team
CVE Reference: CAN-2001-0551

Advisory Location:
http://www.eSecurityOnline.com/advisories/eSO2406.asp

Description:
The CDE dtprintinfo program is vulnerable to a buffer overflow condition that allows a local attacker to gain root access. The problem occurs due to insufficient bounds checking in the Volume search field from the Help section. An attacker can insert a specially crafted string for the search parameter and gain root privileges.

In the dtprintinfo Help, an Index search function permits querying by keyword. If a string of appropriate length is inserted into the 'Entries with' field and a single Help Volume is selected for the search, an exploitable buffer overflow will occur.

Technical Recommendation:
Upgrade with the following patches.

Solaris 2.4, 2.5, 2.5.1 SPARC:
105076-04

Solaris 2.4, 2.5, 2.5.1 x86:
105354-04

Solaris 2.6 SPARC:
106242-03

Solaris 2.6 x86:
106243-03

Solaris 7 SPARC:
107178-02

Solaris 7 x86:
107179-02

Solaris 8 SPARC:
108949-04

Solaris 8 x86:
108950-04


IBM AIX:

AIX 4.3.x:
APAR #IY21539

AIX 5.1:
APAR #IY20917


Compaq:
SSRT1-78U
SSRT0788U
SSRT0757U
SSRT-541


HP-UX:
10.10: PHSS_23355
10.20: PHSS_23796
10.24: PHSS_24097
11.00: PHSS_23797
11.04: PHSS_24098
11.11: PHSS_24087, PHSS_24091

Acknowledgements:
eSecurityOnline would like to thank Sun Microsystems and the Sun security team for their cooperation in resolving the issue.

Copyright 2002 eSecurityOnline LLC. All rights reserved.

THE INFORMATION IN THIS VULNERABILITY ALERT IS PROVIDED BY ESECURITYONLINE LLC "AS IS", "WHERE IS", WITH NO WARRANTY OF ANY KIND, AND ESECURITYONLINE LLC HEREBY DISCLAIMS THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. ESECURITYONLINE LLC SHALL HAVE NO LIABILITY FOR ANY DAMAGE, CLAIM OR LOSS RESULTING FROM YOUR USE OF THE INFORMATION CONTAINED IN THIS VULNERABILITY ALERT.




Spotlight

Staples customers likely the latest victims of credit card breach

Posted on 21 October 2014.  |  Multiple banks say they have identified a pattern of credit and debit card fraud suggesting that several Staples Inc. office supply locations in the Northeastern United States are currently dealing with a data breach.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Wed, Oct 22nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //