-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

          ESB-2003.0789 -- NSFOCUS Security Advisory (SA2003-07)
         HP-UX Software Distributor Buffer Overflow Vulnerability
                             17 November 2003

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Software Distributor utilities
Publisher:              NSFOCUS
Operating System:       HP-UX 11.11
                        HP-UX 11.00
Platform:               HP9000 Series 700/800
Impact:                 Root Compromise
Access Required:        Existing Account
CVE Names:              CAN-2003-0089

Ref:                    ESB-2003.0769

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

NSFOCUS Security Advisory(SA2003-07)

Topic: HP-UX Software Distributor Buffer Overflow Vulnerability

Release Date: 2003-11-13

CVE CAN ID: CAN-2003-0089

http://www.nsfocus.com/english/homepage/research/0307.htm

Affected system:
===================

- - - HP-UX B.11.00
- - - HP-UX B.11.11

Summary:
=========

NSFOCUS Security Team has found a buffer overflow in Software Distributor
utilities for HP-UX. By exploiting the vulnerability local attackers could
gain root privilege.

Description:
============

The Software Distributor(SD) utilities for HP-UX contain a number of programs
such as swinstall. These programs are used to create, install, distribute
and manage software products. A buffer overflow exists in the programs with
suid root bit (such as swinstalll/swmodify etc) and allows local attackers
to run arbitrary code with root privilege.

If the environment variable LANG is set as a over large string, programs such
as swinstall will copy it into a fixed-size buffer without any bound check,
which causes a stack overflow. By overwriting the returned address and other
data in the stack, local attackers could gain root privilege.

Workaround:
=============

NSFOCUS suggests to temporarily remove the suid root bit for all the
programs in SD utilities. 

# chmod a-s /usr/sbin/sw*

Vendor Status:
==============

2002.11.19 Informed the vendor
2002.12.05 Vendor confirmed the vulnerability
2003.11.05 Vendor released a security bulletin (HPSBUX0311-293) and relative
           patches for the vulnerability.

Detailed information for the HP security bulletin is available at:
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0311-293

Note: Valid ITRC account is required for the link above.

Patch ID:

HP-UX B.11.00  PHCO_28847
HP-UX B.11.11  PHCO_28848

Additional Information:
========================

The Common Vulnerabilities and Exposures (CVE) project has assigned the 
name CAN-2003-0089 to this issue. This is a candidate for inclusion in the
CVE list (http://cve.mitre.org), which standardizes names for security 
problems. Candidates may change significantly before they become official
CVE entries.

Acknowledgment
===============

Yang Jilong of NSFOCUS Security Team found the vulnerability. 

DISCLAIMS:
==========
THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY
OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED,
EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO EVENT SHALL NSFOCUS
BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
EVEN IF NSFOCUS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
DISTRIBUTION OR REPRODUCTION OF THE INFORMATION IS PROVIDED THAT THE
ADVISORY IS NOT MODIFIED IN ANY WAY.

Copyright 1999-2003 NSFOCUS. All Rights Reserved. Terms of use.


NSFOCUS Security Team <security@nsfocus.com>
NSFOCUS INFORMATION TECHNOLOGY CO.,LTD
(http://www.nsfocus.com)

PGP Key: http://www.nsfocus.com/homepage/research/pgpkey.asc
Key fingerprint = F8F2 F5D1 EF74 E08C 02FE 1B90 D7BF 7877 C6A6 F6DA
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE/s1Gt1794d8am9toRAi9hAJ9ZDvJdiwPkgd1hSE9IquU06nts2wCfW0UJ
9KQYdGocpQZhGHBHIuB91lQ=
=9nOm
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBP7gNjCh9+71yA2DNAQF8RgP+L8YA97BoKtA8+UUy7xy9juiu08h/CDTN
z0PmJFFsqQelqQTa/AhwvMiVfQy5A4Beofuk3Ng7eJxBiokIw4yR35MzHMK72ZeP
3j+W6bxWQgAUi4dkEf5yBmwmgffLEunHxpPg5xbx4/Fp0ogPLqaPt4N+HNaiEZcy
ikIH855PhHk=
=mzRo
-----END PGP SIGNATURE-----