Re: eSecurityOnline Security Advisory 3761 - Sun Solaris lbxproxy dis play name buffer overflow vulnerability

[Ken.Williams () ey com]

rogersk () hushmail com,

We have tested 108653-41 and confirmed that it does prevent overflow.

Note that SPARC lbxproxy is not set(anything - uid/gid).

We will update eSO-3761 accordingly.

Thank you for the information.

Ken Williams ; CISSP ; Technical Lead ; ken.williams () ey com
eSecurityOnline - an eSecurity Venture of Ernst & Young
ken.williams () ey com ; www.esecurityonline.com ; 1-877-eSecurity



                                                                                                                        
             
                    <rogersk@hush                                                                                       
             
                    mail.com>            To:     bugtraq () securityfocus com                                           
                
                                         cc:                                                                            
             
                    05/01/2002           Subject:     Re: eSecurityOnline Security Advisory 3761 - Sun Solaris lbxproxy 
   dis play  
                    11:34 AM             name buffer overflow vulnerability                                             
             
                                                                                                                        
             
                                                                                                                        
             




In-Reply-To: <200205011234.IAA10988 () koibito iisc com>

The patch descriptions provided at sunsolve.sun.com only
describe the problem as "lbxproxy contains a buffer
overflow", and the dates do not appear to closely match the
discovery date quoted by eSecurityOnline. Is there any
stronger evidence that these patches fix this problem, and
not some unrelated issue with lbxproxy? Has anyone been
able to reproduce the original issue, as well as verifying
that the patch fixes it?

- rogersk () hushmail com

> From: "Charles M. Richmond" <cmr () iisc com>
>
>
> It looks like this buffer overflow is also in the Sparc
versions.
> Solaris 8 - Patch-ID# 108652-51
> Solaris 8x86 - Patch-ID# 108653-41
>
> There are also Solaris 7 patches available.
> 107654-09 (x86 107655-09) which in '-08' addressed a buffer
> overflow issue that affected suid/sgid X programs.
>
>
> > eSO Security Advisory:  3761
> > Discovery Date:         July 5, 2001
> > ID:                     eSO:3761
> > Title:                  Sun Solaris lbxproxy display
name buffer
> >                         overflow vulnerability
> > Impact:                 Local attackers can gain group
root privileges
> > Affected Technology:    Sun Solaris 8 x86
> > Vendor Status:          Vendor notified
> > Discovered By:          Kevin Kotas of the
eSecurityOnline Research
> >                         and Development Team
> > CVE Reference:          CAN-2002-0090
> >
> > Advisory Location:
> > http://www.eSecurityOnline.com/advisories/eSO3761.asp
>
> ***********************************************************
************
> *  Charles Richmond    Integrated International Systems
Corporation   *
> *  cmr () iisc com   cmr () acm org   cmr () shore net
http://www.iisc.com   *
> *  UNIX Internals, I18N, L10N, X, Realtime Imaging, and
Custom S/W   *
> *         131 Bishop's Forest Drive , Waltham , Ma. USA
02452         *
> *  (781) 647 2269   FAX (781) 647 3665   Cellular (781)
389 9777      *
> ***********************************************************
************
>




________________________________________________________________________
The information contained in this message may be privileged and confidential and protected from disclosure.  If the 
reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message 
to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this 
communication is strictly prohibited. If you have received this communication in error, please notify us immediately by 
replying to the message and deleting it from your computer.  Thank you.  Ernst & Young LLP