[PLUG] From the Symantec Newsletter

Jason Dagit dagit at engr.orst.edu
Tue Aug 13 23:19:13 UTC 2002


Does anyone know if this is related to the debian security patches they
have been sending out in the last couple days?  Seems like I saw one for
SunRPC and an integer overflow could lead to root exploit.  Sounds like
the same thing to me...

Jason

On Tue, 13 Aug 2002, J Henshaw wrote:

> Software Flaw Puts Multiple Operating Systems at Risk
> REPRINTED FROM: Computerworld
> AUG 12, 2002    ARTICLE ID: 1531
>
> by Jaikumar Vijayan
>
> Hole in protocol leaves wide range of vendors exposed
>
>
> A security hole in software that's used by numerous technology vendors to
> transfer data between different systems could allow attackers to run
> malicious programs or cause denial-of-service problems on unprotected
> servers, according to warnings issued during the past two weeks.
>
>
> The vulnerability affects the Unix operating systems sold by companies such
> as Sun Microsystems Inc. and IBM, as well as Red Hat Inc.'s versions of
> Linux and Apple Computer Inc.'s Mac OS X Server software (see box). In
> addition, Microsoft Corp. and Hewlett-Packard Co. said they're investigating
> whether their operating systems are at risk.
>
>
> Developers at MIT said the flaw also affects the widely used Kerberos
> authentication software, which was developed at MIT and is designed to let
> end users securely log onto remote systems. A patch is available on the MIT
> Web site.
>
>
> "This vulnerability was one that pertained to such a large number of
> software distributions that we felt it was pertinent to issue an advisory,"
> said Jeff Havrilla, a member of the CERT Coordination Center at Carnegie
> Mellon University in Pittsburgh. "The problem is large enough that pretty
> much every single major operating system vendor has reported being affected
> by it."
>
>
> The vulnerability involves a communication protocol that was developed by
> Sun and is based on its SunRPC remote procedure call technology. The flaw
> exists in a program function distributed as part of an External Data
> Representation (XDR) library that's used by Sun and other vendors to provide
> platform-independent methods for sending data between disparate systems.
>
> Publicized Last Month
>
>
>
> The problem was first publicized by Internet Security Systems Inc. (ISS),
> late last month. ISS said it had found Sun Solaris and the open-source
> FreeBSD and OpenBSD versions of Unix to be vulnerable to the hole.
>
>
> CERT issued an advisory last week and broadened the warning to include other
> vendors, as well as popular applications that are compiled using the flawed
> library. Those include MIT's Kerberos 5 software, the DMI Service Provider
> daemon for remote desktop management and the Common Desktop Environment's
> Calender Manager service.
>
>
> According to the security research organization, the vulnerability is caused
> by an integer overflow in the XDR code that can result in improper memory
> allocations. Attackers could take advantage of the flaw to cause buffer
> overflows that would let them execute code on systems, CERT said.
>
>
> No exploits have been reported so far, Havrilla said. But it won't take long
> for attackers to develop tools that could let them use the hole and scanning
> software that looks for vulnerable systems, he added. Until patches become
> available from vendors, Havrilla said, users can mitigate their exposure by
> disabling the affected services where possible.
>
>
>
>
> _______________________________________________
> PLUG mailing list
> PLUG at lists.pdxlinux.org
> http://lists.pdxlinux.org/mailman/listinfo/plug
>






More information about the PLUG mailing list