Title: Multiple Vendor rpc.cmsd Buffer Overflow Vulnerability
Severity: CRITICAL
Description:
There is a remotely exploitable buffer overflow vulnerability in rpc.cmsd, a component of Sun's Solaris, HP-UX and Caldera OpenUNIX/UnixWare operating systems. Other systems that ship with CDE (such as AIX and Tru64) may also be affected. The consequence is a remote root compromise.
The overflow condition can be triggered by RPC procedure 21, 'rtable_create()'. The procedure accepts two string arguments, one of which is used in an unbounded string copy operation. It is possible for a malicious RPC client to trigger the overflow by invoking the procedure with a string argument that is of excessive length.
The overflow occurs in the internal '_DtCmGetPrefix()' function, when the remotely-supplied string is copied into a local buffer. If the length of the string exceeds the size of the buffer, the function activation record may be corrupted.
It is possible to force the execution of arbitrary code if an attacker can replace the function return address with a pointer to supplied shellcode.
The rpc.cmsd service runs with root privileges. Any attacker who successfully exploits the daemon will gain full root privileges.
Affected Products:
- Caldera OpenUnix 8.0.0
- Caldera UnixWare 7.1.1
- HP HP-UX 10.20.0
- HP HP-UX 10.24.0
- HP HP-UX 10.30.0
- HP HP-UX 11.0.0
- Sun Solaris 2.3.0
- Sun Solaris 2.4.0
- Sun Solaris 2.5.0
- Sun Solaris 2.5.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun SunOS 4.1.3
- Sun SunOS 4.1.3 _U1
- Sun SunOS 4.1.3 c
- Sun SunOS 4.1.4
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
