Orville write environment variables in setuid/setgid binaries buffer overflow
| orvillewrite-variables-bo (12381) |  High Risk |
Description:
Orville write is vulnerable to multiple buffer overflows, caused by insufficient bounds checking of environment variables in the setuid/setgid binaries. Orville write is installed setuid (root) or setgid (tty). By supplying an overly long string to the environment variable, a local attacker can overflow the buffer and cause Orville write to segfault, or execute arbitrary code on the system with elevated privileges, possibly root, if the program was installed setuid, or "tty" group privileges, if the program was installed setgid.
Platforms Affected:
- Debian, Debian Linux 3.0
- Jan Wolter, Orville write 2.53
Remedy:
Upgrade to the latest version of Orville write (2.54 or later), available from the Orville write Web page. See References.
For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest orville-write package (2.53-4woody1 or later), as listed in DSA-326-1. See References.
For other distributions:
Contact your vendor for upgrade or patch information
Consequences:
Gain Privileges
References:
- Debian Bug report logs - #170747, orville-write: Improper use of environmental variables may allow local root compromise. at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=170747.
- Orville write Web site, Jan Wolter's Unix Write Program at http://www.unixpapa.com/write.html.
- BID-7988: Orville-Write Multiple Unspecified Buffer Overrun Vulnerabilities
- CVE-2003-0441: Multiple buffer overflows in Orville Write (orville-write) 2.53 and earlier allow local users to gain privileges.
- DSA-326: orville-write -- buffer overflows
Reported:
Jun 19, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net