Bugtraq mailing list archives
CERT Advisory CA-96.19 - Vulnerability in expreserve
From: cert-advisory () cert org (CERT Advisory)
Date: Thu, 15 Aug 1996 14:00:09 -0500
-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= CERT(sm) Advisory CA-96.19 August 15, 1996 Topic: Vulnerability in expreserve - ----------------------------------------------------------------------------- *** This advisory supersedes CA-93:09 and CA-93:09a. *** The CERT Coordination Center has received reports of a vulnerability in expreserve. Though this is not a new vulnerability, it is one that is widely known and that many users have not yet patched. The CERT/CC team recommends that you patch your system as soon as possible, as exploitation scripts are publicly available. Appendix A contains the information we have received from vendors. Until you can install a patch, you should apply the workaround in Section III below. As we receive additional information relating to this advisory, we will place it in ftp://info.cert.org/pub/cert_advisories/CA-96.19.README We encourage you to check our README files regularly for updates on advisories that relate to your site. - ----------------------------------------------------------------------------- I. Description Expreserve is a utility that preserves the state of a file being edited by vi(1) or ex(1) when an edit session terminates abnormally or when the system crashes. Expreserve has a vulnerability that allows users to overwrite any file on the system. Exploitation scripts are publicly available. II. Impact By exploiting this vulnerability, users with access to an account on the system can readily gain root privileges. III. Solution A. Apply a patch or workaround provided by your vendor. Below is a summary list of the vendors who have provided information, which we have placed in Appendix A of this advisory. If your vendor's name is not on this list, please contact the vendor directly. Berkeley Software Design, Inc. Cray Research Data General Corporation Digital Equipment Corporation Hewlett-Packard Company IBM Corporation NeXT Software, Inc. Open Software Foundation The Santa Cruz Operation, Inc. Sun Microsystems, Inc. B. Until you are able to apply a patch or workaround, we recommend that you remove the execute permissions on the existing /usr/lib/expreserve program. Do this as root: % /usr/bin/chmod a-x /usr/lib/expreserve This workaround disables expreserve functionality. The result of this workaround is that if vi(1) or ex(1) is running, and the sessions are interrupted, the files being edited will not be preserved and all edits not explicitly saved by the users will be lost. Encourage users to save their files often. ......................................................................... Appendix A: Vendor Information Current as of August 15, 1996 See CA-96.19.README for updated information. Below is information we have received from vendors concerning the vulnerability described in this advisory. If you do not see your vendor's name, please contact the vendor directly for information. Berkeley Software Design, Inc. ============================== BSD/OS is not vulnerable to this problem. We ship the current Keith Bostic nvi which does not use the old expreserve scheme to save files (it uses the 4.4BSD-style 1777 tmp directories to store user tmp files in /var/tmp owned by the user and therefore doesn't require a setuid scheme to recover them). Cray Research ============= We have fixed this problem at Cray Research in Unicos version 7.0. Data General Corporation ======================== The binary /usr/lib/expreserve is not a setuid program on DG/UX, any flavor. We are not, therefore, vulnerable to the exploitation described. Nevertheless, the suggested change has been made and will be included in subsequent releases of DG/UX. Digital Equipment Corporation ============================= This reported problem is not present for Digital's ULTRIX or Digital UNIX Operating Systems Software. Source: Digital Equipment Corporation Software Security Response Team Copyright (c) Digital Equipment Corporation 1996. All rights reserved. 8/13/96 - DIGITAL EQUIPMENT CORPORATION Hewlett-Packard Company ======================= Hewlett-Packard recommends that all customers concerned with the security of their HP-UX systems either apply the appropriate patch or perform the actions described below as soon as possible. The vulnerability can be eliminated from releases 9.X of HP-UX by applying a patch: Apply patch PHCO_6363 (series 700/800, HP-UX 9.x), or PHCO_7833 (series 300/400, HP-UX 9.x), or perform the actions described below in releases of HP-UX prior to 9.X, and in 10.X) Since some patches will not be made available on some releases of HP-UX (e.g., prior to 9.X, and now 10.0X), affected systems can be protected by system administrators. They should: $ su root # chmod 0555 /usr/lib/expreserve In the case of 10.X systems execute the following to affect the link target: $ su root # chmod 0555 /usr/lbin/expreserve The default permission for the file /usr/lib/expreserve (or on HP-UX 10.X /usr/lbin/expreserve) needs only minimal privileges. If the patches mentioned above are applied the vulnerability cannot be exploited. Hewlett-Packard Security Bulletin #HPSBUX9607-033, dated July 18, 1996 contains more details. This bulletin is available from http://us.external.hp.com/news/ ftp://info.cert.org/pub/vendors/hp/ IBM Corporation =============== AIX versions 3.2.5, 4.1, and 4.2 are not vulnerable to this particular problem. IBM and AIX are registered trademarks of International Business Machines Corporation. NeXT Software, Inc. =================== This problem was fixed in or before release 3.3 of NeXTstep. Open Software Foundation ======================== OSF's OSF/1 R1.3 is not effected by this vulnerability. The Santa Cruz Operation, Inc. ============================== SCO Operating Systems are not vulnerable to this problem. Sun Microsystems, Inc. ====================== System Patch ID Filename MD5 Checksum - ------ -------- --------------- ----------- SunOS 101080-01 101080-01.tar.Z 53c8a5c4eee770924560c5fc100542a3 Solaris 2.0 101119-01 101119-01.tar.Z No longer available Solaris 2.1 101089-01 101089-01.tar.Z No longer available Solaris 2.2 101090-01 101090-01.tar.Z e9ff98823abbc75d95410a0cb7856644 Solaris 2.3 Solaris 2.4 102756-01 102756-01.tar.Z 61f4a48ddba41ae1c27e70b84f4c8d87 Solaris 2.4_x86 102757-01 102757-01.tar.Z 1f2b7f3824565ef849eb3c4677567399 - --------------------------------------------------------------------------- The CERT Coordination Center thanks all the vendors who provided input for this advisory. - --------------------------------------------------------------------------- If you believe that your system has been compromised, contact the CERT Coordination Center or your representative in the Forum of Incident Response and Security Teams (FIRST). We strongly urge you to encrypt any sensitive information you send by email. The CERT Coordination Center can support a shared DES key and PGP. Contact the CERT staff for more information. Location of CERT PGP key ftp://info.cert.org/pub/CERT_PGP.key CERT Contact Information - ------------------------ Email cert () cert org Phone +1 412-268-7090 (24-hour hotline) CERT personnel answer 8:30-5:00 p.m. EST (GMT-5)/EDT(GMT-4), and are on call for emergencies during other hours. Fax +1 412-268-6989 Postal address CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 USA CERT publications, information about FIRST representatives, and other security-related information are available for anonymous FTP from http://www.cert.org/ ftp://info.cert.org/pub/ CERT advisories and bulletins are also posted on the USENET newsgroup comp.security.announce To be added to our mailing list for CERT advisories and bulletins, send your email address to cert-advisory-request () cert org Copyright 1996 Carnegie Mellon University This material may be reproduced and distributed without permission provided it is used for noncommercial purposes and the copyright statement is included. CERT is a service mark of Carnegie Mellon University. This file: ftp://info.cert.org/pub/cert_advisories/CA-96.19.expreserve http://www.cert.org click on "CERT Advisories" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMhMioXVP+x0t4w7BAQGTfQP/ZJnNG6L2oXmspVN83TZaiFHsb0gVt8+N YKW9NyOGra+x7k4C61P1YAxsb4Abbm7/Ae4jnMwgVZFN4HWiuRl+7N/Zdh8TUbx8 BCLc3XkpPapxOL/ml8zjxhkUYfQt0fjDH/TzoI0N7ZG4DFcdFxPr1FJXuZcj2r8C KbkzUsZmWNo= =TKun -----END PGP SIGNATURE-----
Current thread:
- Re: mail storm Roy Leonard (Aug 13)
- Re: mail storm zero cool (Aug 13)
- Re: mail storm Pete Ashdown (Aug 13)
- Re: mail storm Sean B. Hamor (Aug 13)
- setuid lp script Francis Liu (Aug 13)
- Re: setuid lp script Casper Dik (Aug 15)
- CERT Advisory CA-96.19 - Vulnerability in expreserve CERT Advisory (Aug 15)
- IRIX 5.3 and CA-96.19 - Vulnerability in expreserve? Mike Kienenberger (Aug 15)
- <Possible follow-ups>
- Re: mail storm Brett L. Hawn (Aug 13)
- Re: mail storm John Ladwig (Aug 13)
- Re: mail storm C. Harald Koch (Aug 13)
- Re: mail storm Joe Rhett (Aug 13)
- Re: mail storm Valdis.Kletnieks () vt edu (Aug 13)
- HP elm exploit Clay Shields (Aug 13)
- Re: mail storm der Mouse (Aug 13)
- Re: mail storm J.R.Valverde (Aug 13)