Vulnerability Note VU#336083

Uudecode performs inadequate checks on user-specified output files

Overview

The uudecode utility contains a vulnerability that allows an attacker to overwrite arbitrary files, symbolic links, and named pipes.

I. Description

The uudecode utility is used to decode files that have been encoded in the 7-bit printable format generated by uuencode. This format allows for the specification of a desired output file name, which may also contain an absolute or relative path. Some implementations of uudecode fail to check the specified file name or its type before writing, so it is possible for uudecode to overwrite existing files, including regular files, symbolic links, and named pipes.

If an attacker can convince a user to invoke uudecode on a malicious file without reviewing the included file name, the attacker can cause the user to overwrite any file accessible by the user. If the victim user has root privileges, the attacker can exploit this vulnerability to overwrite arbitrary files. With respect to symbolic links and named pipes, attackers who exploit this vulnerability can alter the normal operation of system scripts and running processes, significantly increasing the risk of system compromise.

This vulnerability was first discovered in the uudecode implementation included with the GNU Sharutils package, but may be present in other implementations as well. For more information on GNU Sharutils, please see http://www.gnu.org/directory/sharutils.html.

II. Impact

Attackers can convince users to overwrite arbitrary files, symbolic links, and named pipes. This ability can be leveraged to gather information, destroy system and user data, and gain control of vulnerable hosts.

III. Solution

Apply a patch from your vendor

Please see the vendor section of this document for information on obtaining patches.

Systems Affected

Vendor	Status	Date Updated
Apple Computer Inc.	Unknown	16-Jul-2002
BSDI	Unknown	16-Jul-2002
Compaq Computer Corporation	Unknown	16-Jul-2002
Cray Inc.	Vulnerable	19-Aug-2002
Data General	Unknown	16-Jul-2002
Debian	Vulnerable	19-Aug-2002
FreeBSD	Unknown	16-Jul-2002
Fujitsu	Not Vulnerable	19-Aug-2002
Gentoo Linux	Vulnerable	13-Dec-2002
GNU Sharutils	Vulnerable	15-Jul-2002
Guardian Digital Inc.	Unknown	16-Jul-2002
Hewlett-Packard Company	Vulnerable	13-Dec-2002
IBM	Unknown	16-Jul-2002
Internet Security Systems Inc.	Vulnerable	19-Aug-2002
MandrakeSoft	Vulnerable	19-Aug-2002
NEC Corporation	Unknown	16-Jul-2002
NetBSD	Unknown	16-Jul-2002
OpenBSD	Unknown	16-Jul-2002
Red Hat Inc.	Vulnerable	16-Jul-2002
Sequent	Unknown	16-Jul-2002
SGI	Unknown	16-Jul-2002
Sony Corporation	Unknown	16-Jul-2002
Sun Microsystems Inc.	Vulnerable	19-Aug-2002
SuSE Inc.	Unknown	22-Jul-2002
The SCO Group (SCO Linux)	Vulnerable	13-Dec-2002
The SCO Group (SCO UnixWare)	Vulnerable	13-Dec-2002
Unisys	Unknown	16-Jul-2002
Wind River Systems Inc.	Unknown	16-Jul-2002

References

http://www.aerasec.de/security/index.html?id=ae-200204-033&lang=en
http://www.gnu.org/directory/sharutils.html
http://www.securityfocus.com/bid/4742

Credit

This vulnerability was discovered by AERAsec.

This document was written by Jeffrey P. Lanza.

Other Information

Date Public	04/16/2002
Date First Published	07/15/2002 01:36:51 PM
Date Last Updated	12/13/2002
CERT Advisory
CVE Name	CAN-2002-0178
US-CERT Technical Alerts
Metric	9.41
Document Revision	28

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader