ISS Security Brief: Solaris fs.auto Remote Compromise Vulnerability (fwd)

[Dave Ahmad <da () securityfocus com>]

David Mirza Ahmad
Symantec

0x26005712
8D 9A B1 33 82 3D B3 D0 40 EB  AB F0 1E 67 C6 1A 26 00 57 12

-----BEGIN PGP SIGNED MESSAGE-----

ISS X-Force Security Brief
November 25, 2002

Solaris fs.auto Remote Compromise Vulnerability

Synopsis:

ISS X-Force has discovered a vulnerability in the Sun Microsystems
implementation of the "X Window Font Service", or "XFS". The XFS service was
designed as a component of the X Windows systems to establish a common
mechanism to export font data to all computers on an X Windows network. A
buffer overflow vulnerability exists within the XFS service (fs.auto).

Impact:

Remote attackers can exploit the buffer overflow vulnerability to run
arbitrary commands on a target system. Attackers must exploit this
vulnerability in conjunction with another attack to gain "root" access,
because the fs.auto service does not run with superuser privilege. The Solaris
operating system is configured to run the fs.auto service by default. It is
bound to a high TCP port, which is normally blocked on perimeter firewalls.
Networks that are not filtering high TCP ports, and internal networks are
potentially at risk.

Affected Versions:

Sun Microsystems Solaris 2.5.1 (Sparc/Intel)
Sun Microsystems Solaris 2.6 (Sparc/Intel)
Sun Microsystems Solaris 7 (Sparc/Intel)
Sun Microsystems Solaris 8 (Sparc/Intel)
Sun Microsystems Solaris 9 (Sparc)
Sun Microsystems Solaris 9 Update 2 (Intel)

For the complete ISS X-Force Security Alert, please visit:

http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21541

______

About Internet Security Systems (ISS) Founded in 1994, Internet Security
Systems (ISS) (Nasdaq: ISSX) is a pioneer and world leader in software
and services that protect critical online resources from an ever-
changing spectrum of threats and misuse. Internet Security Systems is
headquartered in Atlanta, GA, with additional operations throughout the
Americas, Asia, Australia, Europe and the Middle East.

Copyright (c) 2002 Internet Security Systems, Inc. All rights reserved
worldwide.

Permission is hereby granted for the electronic redistribution of this
document. It is not to be edited or altered in any way without the
express written consent of the Internet Security Systems X-Force. If you
wish to reprint the whole or any part of this document in any other
medium excluding electronic media, please email xforce () iss net for
permission.

Disclaimer: The information within this paper may change without notice.
Use of this information constitutes acceptance for use in an AS IS
condition. There are NO warranties, implied or otherwise, with regard to
this information or its use. Any use of this information is at the
user's risk. In no event shall the author/distributor (Internet Security
Systems X-Force) be held liable for any damages whatsoever arising out
of or in connection with the use or spread of this information.

X-Force PGP Key available on MIT's PGP key server and PGP.com's key
server, as well as at http://www.iss.net/security_center/sensitive.php

Please send suggestions, updates, and comments to: X-Force
xforce () iss net of Internet Security Systems, Inc.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBPeJVADRfJiV99eG9AQFaagP9GJlMjVgMCpm6ycjB8dF6hMfvdqI4DJDf
bTAe+chCGVIcqc1iD5xcdj/kCc8bjOLM+SW7W4LUpIszg0WxExpXMKTd64yflsdF
VZKgNAxkOor2o9XT1mwneZC1/E+KDwV+1x+b0jrAEh5dbWFefKdfe2JEh2xsf/Mh
OxXDC7TBvkk=
=7mVn
-----END PGP SIGNATURE-----