Title: Canna subsystem 'canuum' Buffer Overflow Vulnerability
Severity: INFO
Description:
Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese.
Canna supports Nemacs(Mule), kinput2 and canuum. All of these tools can be used by a single customization file, romaji-to-kana conversion rules and conversion dictionaries, and input Japanese in the same way.
Canna converts kana to kanji based on a client-server model and supports automatic kana-to-kanji conversion.
The Canna subsystem on certain UNIX versions contains a buffer overflow in the 'canuum' program. Canuum is a Japanese input tty frontend for Canna using uum. Certain versions have a buffer overflow via unchecked user supplied data in the -k,-c,-n options.
Since this program is installed SUID root this attack will result in a root level compromise.
Affected Products:
- Turbolinux Turbolinux 3.5.0b2
References:
- Shadow Penguin Security: Penguin Toolbox #54: EmailClub
- TurboLinux: TurboLinux Support
- eEye: eEye Digital Security Team Home Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
