Published:
13 September 1999
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-1999.142 -- RHSA-1999:037-01 Buffer overflow in mars_nwe 14 September 1999 =========================================================================== Red Hat, Inc. has released the following advisory concerning several buffer overflow vulnerabilities in the mars_nwe package. As this package runs as root, these vulnerabilities may be leveraged by local users to gain root access. Exploit information involving these vulnerabilities has been made available. - --------------------------BEGIN INCLUDED TEXT-------------------- - --------------------------------------------------------------------- Red Hat, Inc. Security Advisory Synopsis: Buffer overflow in mars_nwe Advisory ID: RHSA-1999:037-01 Issue date: 1999-09-13 Updated on: Keywords: mars_nwe buffer Cross references: - --------------------------------------------------------------------- 1. Topic: There are several buffer overruns in the mars_nwe package. 2. Bug IDs fixed (http://developer.redhat.com/bugzilla for more info): 5002 3. Relevant releases/architectures: Red Hat Linux 6.0, all architectures Red Hat Linux 4.2, 5.2 Intel (mars_nwe was not built for Alpha and Sparc in previous versions of Red Hat Linux.) 4. Obsoleted by: 5. Conflicts with: 6. RPMs required: Red Hat Linux 4.2: Intel: ftp://updates.redhat.com//4.2/i386/mars-nwe-0.99pl17-0.4.2.i386.rpm Source packages: ftp://updates.redhat.com//4.2/SRPMS/mars-nwe-0.99pl17-0.4.2.src.rpm Red Hat Linux 5.2: Intel: ftp://updates.redhat.com//5.2/i386/mars-nwe-0.99pl17-0.5.2.i386.rpm Source packages: ftp://updates.redhat.com//5.2/SRPMS/mars-nwe-0.99pl17-0.5.2.src.rpm Red Hat Linux 6.0: Intel: ftp://updates.redhat.com//6.0/i386/mars-nwe-0.99pl17-4.i386.rpm Alpha: ftp://updates.redhat.com//6.0/alpha/mars-nwe-0.99pl17-4.alpha.rpm Sparc: ftp://updates.redhat.com//6.0/sparc/mars-nwe-0.99pl17-4.sparc.rpm Source packages: ftp://updates.redhat.com//6.0/SRPMS/mars-nwe-0.99pl17-4.src.rpm 7. Problem description: Buffer overflows are present in the mars_nwe package. Since the code that contains these overflows is run as root, a local root compromise is possible if users create carefully designed directories and/or bindery objects. A sample exploit has been made available. Thanks go to Przemyslaw Frasunek (secure@freebsdf.lublin.pl) and Babcia Padlina Ltd. for noting the problem and providing a patch. 8. Solution: For each RPM for your particular architecture, run: rpm -Uvh <filename> where filename is the name of the RPM. 9. Verification: MD5 sum Package Name - -------------------------------------------------------------------------- 350882fd246344891f04d7419561eb8f i386/mars-nwe-0.99pl17-0.4.2.i386.rpm 99134c2f507c906483320b9748b6334c SRPMS/mars-nwe-0.99pl17-0.4.2.src.rpm 2dd6f7cf55f8ed68ba40b9d98a91adaf i386/mars-nwe-0.99pl17-0.5.2.i386.rpm e3d918c4e52ef051d169d7380e4d8cfe SRPMS/mars-nwe-0.99pl17-0.5.2.src.rpm adbd809d9de3d22fed637bcf56ede66f i386/mars-nwe-0.99pl17-4.i386.rpm 729f888a3c1ebb87bcf04c204bf7b9dc alpha/mars-nwe-0.99pl17-4.alpha.rpm bf73f67c225c2edce4d7ee52b5796803 sparc/mars-nwe-0.99pl17-4.sparc.rpm b9c61129b2e04d25c48863ededc35568 SRPMS/mars-nwe-0.99pl17-4.src.rpm These packages are PGP signed by Red Hat Inc. for security. Our key is available at: http://www.redhat.com/corp/contact.html You can verify each package with the following command: rpm --checksig <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nopgp <filename> 10. References: Bugtraq ID: 617 <19990830200449.54656.qmail@lagoon.FreeBSD.lublin.pl> - --------------------------END INCLUDED TEXT-------------------- This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to use any or all of this information is the responsibility of each user or organisation, and should be done so in accordance with site policies and procedures. NOTE: This is only the original release of the security bulletin. It will not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the original authors to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/Information/advisories.html If you believe that your system has been compromised, contact AusCERT or your representative in FIRST (Forum of Incident Response and Security Teams). Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for emergencies. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBN+dwMCh9+71yA2DNAQFipQP/eHNi9kVVPNsbRibTNoEKsMRbJGVCYqkC AFgI8ob0FLXoPWBRLKeKn821o6b4fAJHwzcp0mVbBTVstWhdFp9mUmo6BAb0LO1K cNEAmdBEWTtS8ewuqu3LN/LX04CRSp1PphWIkezNTnfVZNP6ZFL+ocS8LVRZxTzX /ZXdUbM8rqI= =xqNf -----END PGP SIGNATURE-----