[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 449/05 - IBM - Two Security Advisories



 
-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 449/05 dated 13.06.05  Time: 16:00  
  UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------

Title
=====
IBM - Two Security Advisories:
     1.  A local user may gain root privileges through the perl interpreter
     2.  Buffer overflow vulnerability in penable command 


Detail
====== 

Security Advisory summaries:

     1.  Two vulnerabilities were discovered in the perl language interpreter that
         may allow a local user to gain root privileges. The perl interpreter is
         installed by default in AIX 5.2 and AIX 5.3. 

     2.  A vulnerability was discovered in the penable command that allows a
         local user in the system group to gain root privileges. Exploits for this
         vulnerability may be publicly available.


Security Advisory content follows:


1.


AIX 5.3 : Security advisories (2005.06.10)

A local user may gain root privileges through the perl interpreter.

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


IBM SECURITY ADVISORY

First Issued: Mon Feb 14 13:26:10 CST 2005

|Updated : Fri Feb 25 09:57:19 CST 2005
| New AIX 5.2 efix package eliminates issue with multi-processor machines.
| Added APAR information 
|Updated : Fri Jun 10 15:19:40 CDT 2005
|  Remove interim fix and workaround information

==========================================================================
                           VULNERABILITY SUMMARY

VULNERABILITY:      A local user may gain root privileges through the
                    perl interpreter.

PLATFORMS:          AIX 5.2, AIX 5.3

|SOLUTION:           Apply APARs as described below.

THREAT:             A local user may gain root access to a system.

CERT VU Number:     None.
CVE Number:         CAN-2005-0155, CAN-2005-0156
==========================================================================
                           DETAILED INFORMATION


I.  Description
===============

Two vulnerabilities were discovered in the perl language interpreter that
may allow a local user to gain root privileges. The perl interpreter is
installed by default in AIX 5.2 and AIX 5.3. Versions of AIX prior to 5.2
do not have perl installed by default and are not vulnerable. Also, these
vulnerabilities occur only in perl with versions 5.8.0 through 5.8.6.

CAN-2005-0155
The first vulnerability is through the sperl program which runs perl as an
suid root process. This perl facility is not installed by default on AIX,
but the same vulnerability may exist if perl is invoked by another suid
root program.

CAN-2005-0156
The second vulnerability is in the perl interpreter itself and is a buffer
overflow. This is only specific to perl built with threads support, which
is supported in the AIX perl package.

The perl language ships in the perl.rte filesets. To determine if this
fileset is installed, execute the following command:

# lslpp -L perl.rte

If the fileset is installed, it will be listed along with its version
information, state, type and a description.


II. Impact
==========
A local attacker may gain root access to a system.


III.  Solutions
===============

A. Official Fix

|IBM will provide the following fixes:
|
|APAR number for AIX 5.2.0: IY68464  (currently available)
|APAR number for AIX 5.3.0: IY68463  (currently available)
|
|NOTE: Affected customers are urged to upgrade to 5.2.0 or
|5.3.0 at the latest maintenance level.


| Updated: Fri Jun 10 15:19:40 CDT 2005
| Removed interim fix and workaround information.


IV. Obtaining Fixes
====================
AIX Version 5 APARs can be downloaded from:

     http://www-1.ibm.com/servers/eserver/support/pseries/aixfixes.html


Security related Emergency Fixes can be downloaded from:

     ftp://aix.software.ibm.com/aix/efixes/security


V. Acknowledgments
====================

The perl vulnerabilities were discovered by Kevin Kinisterre.

This issue was brought to our attention by Campo Weijerman of
IBM Netherlands.

This document was written by Kent Stuiber.


VI.  Contact Information
========================

If you would like to receive AIX Security Advisories via email, please
visit:
     https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs

Comments regarding the content of this announcement can be directed to:

     security-alert@xxxxxxxxxxxxxx

To request the PGP public key that can be used to communicate securely
with the AIX Security Team send email to security-alert@xxxxxxxxxxxxxx
with a subject of "get key". The key can also be downloaded from a
PGP Public Key Server. The key id is 0x9391C1F2.

Please contact your local IBM AIX support center for any assistance.

eServer is a trademark of International Business Machines Corporation.
IBM, AIX and pSeries are registered trademarks of International Business
Machines Corporation. All other trademarks are property of their
respective holders.

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (AIX)

iD8DBQFCqgO4xwSSvpORwfIRArqnAJ44Dhci72/TZ4TI7Al4kKcxqXfzjACfT2PM
QzVxCqhvRyd2F1eb5tYtjqs=
=Bsaf
- -----END PGP SIGNATURE-----


- ---------------------------------------------------------------------

  Related URLs:

  Find end of support dates for AIX and software running on AIX
  http://www.ibm.com/services/sl/products

  Visit pSeries Support for a wide array of technical resources.
  http://www.ibm.com/server/eserver/support/pseries

  Download fixes for AIX V5 and 4.3 OS, Java, Compilers:
  http://www.ibm.com/servers/eserver/support/pseries/aixfixes.html
  
  Update your Subscription Service profile
  https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=2

  Unsubscribe from Subscription Service
  https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=3

  Sign up for customized weekly newsletter from IBM
  https://isource.ibm.com/world/index.shtml

- ----------------------------------------------------------------------
IBM, eServer and pSeries are trademarks or registered trademarks of the
International Business Machines Corporation in the United States or other countries, or both.
ALL INFORMATION IS PROVIDED BY IBM ON AN "AS IS" BASIS ONLY. IBM PROVIDES NO REPRESENTATIONS
OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR
PURPOSE, MERCHANTABILITY AND NONINFRINGMENT. This document may be copied provided all text is
included and copies contain IBM's copyright notice and any other notices provided herein.




2.




AIX 5.3 : Security advisories (2005.06.10)

Buffer overflow vulnerability in penable command

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued:  Fri Jun 10 13:12:27 CDT 2005

==========================================================================
                           VULNERABILITY SUMMARY

VULNERABILITY:      A buffer overflow vulnerability in the penable command
                    may allow any local user in the system group to gain
                    root privileges.

PLATFORMS:          AIX 5.1, 5.2 and 5.3.

SOLUTION:           Apply the workaround as described below.

THREAT:             A local user in the system group may gain root
                    privileges.

CERT VU Number:     N/A
CVE Number:         N/A
=========================================================================
                           DETAILED INFORMATION


I.  Description
===============

A vulnerability was discovered in the penable command that allows a
local user in the system group to gain root privileges. Exploits for this
vulnerability may be publicly available. penable is one of six hard links.
The other hard links are pdisable, pstart, phold, pdelay and pshare. These
commands are used to perform various port management functions.

The command affected by this issue ships as part of the bos.rte.control
fileset. To determine if this fileset is installed, execute the following
command:

# lslpp -w /usr/sbin/penable

If the fileset is installed it will be listed along with its version
information, state, type and a description.


II. Impact
==========

A local user in the system group may exploit this buffer overflow
vulnerability to gain root privileges.


III.  Solutions
===============

A. APARs and interim fixes

APARs and interim fixes will be provided. An updated advisory will be
published when these fixes are available.


B. Workaround

Setting the file mode bits to 500 will allow only the root user to execute
this command. This can be done by executing the following command as root:

# chmod 500 /usr/sbin/penable

Since penable, pdisable, pstart, phold, pdelay and pshare are hard links to
the same file, they will all be affected by this change.

Verify that the file mode bits have been updated:

# ls -la /usr/sbin/penable   
- - -r-x------   6 root     system        19366 May 16 14:30 /usr/sbin/penable


IV. Obtaining Fixes
===================

AIX Version 5 APARs can be downloaded from:

     http://www-1.ibm.com/servers/eserver/support/pseries/aixfixes.html

Security related Interim Fixes can be downloaded from:

     ftp://aix.software.ibm.com/aix/efixes/security


V.  Contact Information
=======================

If you would like to receive AIX Security Advisories via email, please
visit:

     https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs

Comments regarding the content of this announcement can be directed to:

     security-alert@xxxxxxxxxxxxxx

To request the PGP public key that can be used to communicate securely
with the AIX Security Team send email to security-alert@xxxxxxxxxxxxxx
with a subject of "get key". The key can also be downloaded from a PGP
Public Key Server. The key id is 0x9391C1F2.

Please contact your local IBM AIX support center for any assistance.

eServer is a trademark of International Business Machines Corporation.
IBM, AIX and pSeries are registered trademarks of International Business
Machines Corporation. All other trademarks are property of their respective
holders.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCqdwTxwSSvpORwfIRAhFVAJ9BCtxN48zCkWiUSt/wKVuWCnouqACdEBuk
NpDh9MGpmVwKMPfaQ6uAy0I=
=Rtr+
- -----END PGP SIGNATURE-----


- ---------------------------------------------------------------------

  Related URLs:

  Find end of support dates for AIX and software running on AIX
  http://www.ibm.com/services/sl/products

  Visit pSeries Support for a wide array of technical resources.
  http://www.ibm.com/server/eserver/support/pseries

  Download fixes for AIX V5 and 4.3 OS, Java, Compilers:
  http://www.ibm.com/servers/eserver/support/pseries/aixfixes.html
  
  Update your Subscription Service profile
  https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=2

  Unsubscribe from Subscription Service
  https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=3

  Sign up for customized weekly newsletter from IBM
  https://isource.ibm.com/world/index.shtml

- ----------------------------------------------------------------------
IBM, eServer and pSeries are trademarks or registered trademarks of the
International Business Machines Corporation in the United States or other countries, or both.
ALL INFORMATION IS PROVIDED BY IBM ON AN "AS IS" BASIS ONLY. IBM PROVIDES NO REPRESENTATIONS
OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR
PURPOSE, MERCHANTABILITY AND NONINFRINGMENT. This document may be copied provided all text is
included and copies contain IBM's copyright notice and any other notices provided herein.


- ----------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via 
EMail to: uniras@xxxxxxxxxxxx

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 870 487 0748 Ext 4511
Fax: +44 (0) 870 487 0749

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 870 487 0748 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of IBM for the information 
contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQCVAwUBQq2ek4pao72zK539AQGQfwP+PPpQQOGBDcFGJNPuUfpr0rEjp7hzIMIF
Kq++31ztVPzIzPJ9DKH+QPgaCycLfc8ACPwtVFmOotwZQ5B9U3MNPQDGQVD57PW8
1jKSGPgDhG7gKtOfkBQDfBNwb24VTNNvr1s+b1S7FZ2o4qqom8qR7EaJVO/06Zb0
56bLnM4+apI=
=N3oI
-----END PGP SIGNATURE-----


______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________