Skip Navigation

  • Home
  • Contact us
  • FAQ
  • Glossary
  • Public key
  • Sitemap
  • Cymraeg
  • What's new
CPNI - Centre for the Protection of National Infastructure

Advanced search

  • About CPNI
  • The threats
  • Security planning
  • Methods of attack
  • Protecting your assets
  • Products and services
    • CSIRTUK advisories
      • Advisories archive
    • General protective security publications
    • InfoSec briefings
    • InfoSec technical notes
    • InfoSec vulnerability disclosures
    • Good practice guidelines
    • Viewpoints
    • Information exchanges
    • Risk Management Delivery Group
  • Research
Home > Products and services > CSIRTUK advisories > Advisories archive > June 2005 > IBM - Two Security Advisories: 1. A local user may gain root privileges through the perl interpreter -- 2. Buffer overflow vulnerability in penable command

June 2005

IBM - Two Security Advisories: 1. A local user may gain root privileges through the perl interpreter -- 2. Buffer overflow vulnerability in penable command

ID: 00485
Ref: 449/2005
Date: 13 June 2005:16:21:09
Version: 1
Title: IBM - Two Security Advisories: 1. A local user may gain root privileges through the perl interpreter -- 2. Buffer overflow vulnerability in penable command
Abstract:
Vendors affected: IBM
Operating systems affected: IBM
Applications affected: IBM

Title
=====
IBM - Two Security Advisories:
1. A local user may gain root privileges through the perl interpreter
2. Buffer overflow vulnerability in penable command


Detail
======

Security Advisory summaries:

1. Two vulnerabilities were discovered in the perl language interpreter that
may allow a local user to gain root privileges. The perl interpreter is
installed by default in AIX 5.2 and AIX 5.3.

2. A vulnerability was discovered in the penable command that allows a
local user in the system group to gain root privileges. Exploits for this
vulnerability may be publicly available.


Security Advisory content follows:


1.


AIX 5.3 : Security advisories (2005.06.10)

A local user may gain root privileges through the perl interpreter.

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


IBM SECURITY ADVISORY

First Issued: Mon Feb 14 13:26:10 CST 2005

|Updated : Fri Feb 25 09:57:19 CST 2005
| New AIX 5.2 efix package eliminates issue with multi-processor machines.
| Added APAR information
|Updated : Fri Jun 10 15:19:40 CDT 2005
| Remove interim fix and workaround information

==========================================================================
VULNERABILITY SUMMARY

VULNERABILITY: A local user may gain root privileges through the
perl interpreter.

PLATFORMS: AIX 5.2, AIX 5.3

|SOLUTION: Apply APARs as described below.

THREAT: A local user may gain root access to a system.

CERT VU Number: None.
CVE Number: CAN-2005-0155, CAN-2005-0156
==========================================================================
DETAILED INFORMATION


I. Description
===============

Two vulnerabilities were discovered in the perl language interpreter that
may allow a local user to gain root privileges. The perl interpreter is
installed by default in AIX 5.2 and AIX 5.3. Versions of AIX prior to 5.2
do not have perl installed by default and are not vulnerable. Also, these
vulnerabilities occur only in perl with versions 5.8.0 through 5.8.6.

CAN-2005-0155
The first vulnerability is through the sperl program which runs perl as an
suid root process. This perl facility is not installed by default on AIX,
but the same vulnerability may exist if perl is invoked by another suid
root program.

CAN-2005-0156
The second vulnerability is in the perl interpreter itself and is a buffer
overflow. This is only specific to perl built with threads support, which
is supported in the AIX perl package.

The perl language ships in the perl.rte filesets. To determine if this
fileset is installed, execute the following command:

# lslpp -L perl.rte

If the fileset is installed, it will be listed along with its version
information, state, type and a description.


II. Impact
==========
A local attacker may gain root access to a system.


III. Solutions
===============

A. Official Fix

|IBM will provide the following fixes:
|
|APAR number for AIX 5.2.0: IY68464 (currently available)
|APAR number for AIX 5.3.0: IY68463 (currently available)
|
|NOTE: Affected customers are urged to upgrade to 5.2.0 or
|5.3.0 at the latest maintenance level.


| Updated: Fri Jun 10 15:19:40 CDT 2005
| Removed interim fix and workaround information.


IV. Obtaining Fixes
====================
AIX Version 5 APARs can be downloaded from:

http://www-1.ibm.com/servers/eserver/support/pseries/aixfixes.html


Security related Emergency Fixes can be downloaded from:

ftp://aix.software.ibm.com/aix/efixes/security


V. Acknowledgments
====================

The perl vulnerabilities were discovered by Kevin Kinisterre.

This issue was brought to our attention by Campo Weijerman of
IBM Netherlands.

This document was written by Kent Stuiber.


VI. Contact Information
========================

If you would like to receive AIX Security Advisories via email, please
visit:
https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs

Comments regarding the content of this announcement can be directed to:

security-alert@austin.ibm.com

To request the PGP public key that can be used to communicate securely
with the AIX Security Team send email to security-alert@austin.ibm.com
with a subject of "get key". The key can also be downloaded from a
PGP Public Key Server. The key id is 0x9391C1F2.

Please contact your local IBM AIX support center for any assistance.

eServer is a trademark of International Business Machines Corporation.
IBM, AIX and pSeries are registered trademarks of International Business
Machines Corporation. All other trademarks are property of their
respective holders.

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (AIX)

iD8DBQFCqgO4xwSSvpORwfIRArqnAJ44Dhci72/TZ4TI7Al4kKcxqXfzjACfT2PM
QzVxCqhvRyd2F1eb5tYtjqs=
=Bsaf
- -----END PGP SIGNATURE-----


- ---------------------------------------------------------------------

Related URLs:

Find end of support dates for AIX and software running on AIX
http://www.ibm.com/services/sl/products

Visit pSeries Support for a wide array of technical resources.
http://www.ibm.com/server/eserver/support/pseries

Download fixes for AIX V5 and 4.3 OS, Java, Compilers:
http://www.ibm.com/servers/eserver/support/pseries/aixfixes.html

Update your Subscription Service profile
https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=2

Unsubscribe from Subscription Service
https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=3

Sign up for customized weekly newsletter from IBM
https://isource.ibm.com/world/index.shtml

- ----------------------------------------------------------------------
IBM, eServer and pSeries are trademarks or registered trademarks of the
International Business Machines Corporation in the United States or other countries, or both.
ALL INFORMATION IS PROVIDED BY IBM ON AN "AS IS" BASIS ONLY. IBM PROVIDES NO REPRESENTATIONS
OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR
PURPOSE, MERCHANTABILITY AND NONINFRINGMENT. This document may be copied provided all text is
included and copies contain IBM's copyright notice and any other notices provided herein.




2.




AIX 5.3 : Security advisories (2005.06.10)

Buffer overflow vulnerability in penable command

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Fri Jun 10 13:12:27 CDT 2005

==========================================================================
VULNERABILITY SUMMARY

VULNERABILITY: A buffer overflow vulnerability in the penable command
may allow any local user in the system group to gain
root privileges.

PLATFORMS: AIX 5.1, 5.2 and 5.3.

SOLUTION: Apply the workaround as described below.

THREAT: A local user in the system group may gain root
privileges.

CERT VU Number: N/A
CVE Number: N/A
=========================================================================
DETAILED INFORMATION


I. Description
===============

A vulnerability was discovered in the penable command that allows a
local user in the system group to gain root privileges. Exploits for this
vulnerability may be publicly available. penable is one of six hard links.
The other hard links are pdisable, pstart, phold, pdelay and pshare. These
commands are used to perform various port management functions.

The command affected by this issue ships as part of the bos.rte.control
fileset. To determine if this fileset is installed, execute the following
command:

# lslpp -w /usr/sbin/penable

If the fileset is installed it will be listed along with its version
information, state, type and a description.


II. Impact
==========

A local user in the system group may exploit this buffer overflow
vulnerability to gain root privileges.


III. Solutions
===============

A. APARs and interim fixes

APARs and interim fixes will be provided. An updated advisory will be
published when these fixes are available.


B. Workaround

Setting the file mode bits to 500 will allow only the root user to execute
this command. This can be done by executing the following command as root:

# chmod 500 /usr/sbin/penable

Since penable, pdisable, pstart, phold, pdelay and pshare are hard links to
the same file, they will all be affected by this change.

Verify that the file mode bits have been updated:

# ls -la /usr/sbin/penable
- - -r-x------ 6 root system 19366 May 16 14:30 /usr/sbin/penable


IV. Obtaining Fixes
===================

AIX Version 5 APARs can be downloaded from:

http://www-1.ibm.com/servers/eserver/support/pseries/aixfixes.html

Security related Interim Fixes can be downloaded from:

ftp://aix.software.ibm.com/aix/efixes/security


V. Contact Information
=======================

If you would like to receive AIX Security Advisories via email, please
visit:

https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs

Comments regarding the content of this announcement can be directed to:

security-alert@austin.ibm.com

To request the PGP public key that can be used to communicate securely
with the AIX Security Team send email to security-alert@austin.ibm.com
with a subject of "get key". The key can also be downloaded from a PGP
Public Key Server. The key id is 0x9391C1F2.

Please contact your local IBM AIX support center for any assistance.

eServer is a trademark of International Business Machines Corporation.
IBM, AIX and pSeries are registered trademarks of International Business
Machines Corporation. All other trademarks are property of their respective
holders.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCqdwTxwSSvpORwfIRAhFVAJ9BCtxN48zCkWiUSt/wKVuWCnouqACdEBuk
NpDh9MGpmVwKMPfaQ6uAy0I=
=Rtr+
- -----END PGP SIGNATURE-----


- ---------------------------------------------------------------------

Related URLs:

Find end of support dates for AIX and software running on AIX
http://www.ibm.com/services/sl/products

Visit pSeries Support for a wide array of technical resources.
http://www.ibm.com/server/eserver/support/pseries

Download fixes for AIX V5 and 4.3 OS, Java, Compilers:
http://www.ibm.com/servers/eserver/support/pseries/aixfixes.html

Update your Subscription Service profile
https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=2

Unsubscribe from Subscription Service
https://techsupport.services.ibm.com/server/pseries.subscriptionSvcs?mode=3

Sign up for customized weekly newsletter from IBM
https://isource.ibm.com/world/index.shtml

- ----------------------------------------------------------------------
IBM, eServer and pSeries are trademarks or registered trademarks of the
International Business Machines Corporation in the United States or other countries, or both.
ALL INFORMATION IS PROVIDED BY IBM ON AN "AS IS" BASIS ONLY. IBM PROVIDES NO REPRESENTATIONS
OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR
PURPOSE, MERCHANTABILITY AND NONINFRINGMENT. This document may be copied provided all text is
included and copies contain IBM's copyright notice and any other notices provided herein.



  • Accessibility |
  • Terms and conditions |
  • Privacy statement |
  • Data protection act |
  • Freedom of information |