Vulnerability Note VU#516825

Integer overflow in Sun RPC XDR library routines

Overview

The XDR library from Sun Microsystems is a widely used implementation for RPC services. Although the library was originally distributed by Sun Microsystems, multiple vendors have included the vulnerable code in their own implementations. Some implementations of standard functions in this API may contain an integer overflow.

I. Description

The XDR (external data representation) libraries are used to provide platform-independent methods for sending data from one system process to another, typically over a network connection. Such routines are commonly used in remote procedure call (RPC) implementations to provide transparency to application programmers who need to use common interfaces to interact with many different types of systems.

Some memory allocation routines in the XDR library provided by Sun Microsystems contain an integer overflow that can lead to improperly sized dynamic memory allocation. The length of the allocated buffer is interpreted as a signed integer, whereas the callers interpret the length as an unsigned integer. The xdrmem_getbytes() function is one example of where the flaw may occur. Subsequent problems like buffer overflows may result, depending on how and where the vulnerable xdrmem_getbytes() function is used. Other functions in the xdrmem_*() family may suffer from an identical error.

Researchers at eEye Digital Security discovered this vulnerability and have also published an advisory. This vulnerability is similar to, but distinct from, VU#192995.

II. Impact

Because Sun RPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information. Furthermore, because RPC services often run as root on affected systems, this vulnerability may be leveraged to gain remote root access on vulnerable systems.

III. Solution

Apply a patch from the vendor

Several vendors of relevant or derived implementations have released patches to address this vulnerability; please see the vendor section of this document for further details.

Workarounds

Disable access to vulnerable services or applications

Until patches are available and can be applied, you may wish to disable access to services or applications compiled with the vulnerable xdrmem_*() functions. As a best practice, the CERT/CC recommends disabling all services that are not explicitly required.

Systems Affected

Vendor	Status	Date Notified
3Com	Unknown	18-Feb-2003
Alcatel	Unknown	18-Feb-2003
Apple Computer Inc.	Not Vulnerable	21-Feb-2003
AT&T	Unknown	18-Feb-2003
Avaya	Unknown	18-Feb-2003
BSDI	Unknown	18-Feb-2003
Cisco Systems Inc.	Unknown	18-Feb-2003
Compaq Computer Corporation	Vulnerable	18-Apr-2003
Computer Associates	Unknown	18-Feb-2003
Conectiva	Vulnerable	9-May-2003
Cray Inc.	Unknown	21-Feb-2003
D-Link Systems	Unknown	18-Feb-2003
Data General	Unknown	18-Feb-2003
Debian	Vulnerable	9-Apr-2003
F5 Networks	Unknown	18-Feb-2003
Foundry Networks Inc.	Unknown	18-Feb-2003
FreeBSD	Vulnerable	20-Mar-2003
Fujitsu	Unknown	21-Feb-2003
Gentoo Linux	Vulnerable	31-Mar-2003
GNU glibc	Vulnerable	21-Feb-2003
Guardian Digital Inc.	Vulnerable	21-Mar-2003
Heimdal Kerberos Project	Unknown	18-Feb-2003
Hewlett-Packard Company	Vulnerable	11-Feb-2004
Hitachi	Not Vulnerable	20-Mar-2003
IBM	Vulnerable	18-Mar-2003
IBM-zSeries	Unknown	18-Feb-2003
Ingrian Networks	Not Vulnerable	10-Mar-2003
Intel	Unknown	18-Feb-2003
Juniper Networks	Unknown	18-Feb-2003
KTH Kerberos Development Team	Unknown	18-Feb-2003
Lotus Software	Unknown	18-Feb-2003
Lucent Technologies	Unknown	18-Feb-2003
MandrakeSoft	Vulnerable	1-Apr-2003
Microsoft Corporation	Unknown	18-Feb-2003
MiT Kerberos Development Team	Vulnerable	20-Mar-2003
MontaVista Software	Unknown	18-Feb-2003
Multinet	Unknown	18-Feb-2003
NEC Corporation	Not Vulnerable	7-Mar-2003
NetBSD	Vulnerable	26-Mar-2003
NetScreen	Unknown	18-Feb-2003
Network Appliance	Not Vulnerable	18-Mar-2003
NeXT	Unknown	18-Feb-2003
Nokia	Not Vulnerable	21-Feb-2003
Nortel Networks	Vulnerable	9-Apr-2003
Open Group	Unknown	18-Feb-2003
OpenAFS	Unknown	21-Feb-2003
OpenBSD	Unknown	18-Feb-2003
Openwall GNU/*/Linux	Unknown	24-Mar-2003
Oracle Corporation	Unknown	18-Feb-2003
Red Hat Inc.	Vulnerable	2-Apr-2003
Redback Networks Inc.	Unknown	21-Feb-2003
Riverstone Networks	Unknown	20-Feb-2003
RSA Security	Unknown	18-Feb-2003
Sequent	Unknown	18-Feb-2003
SGI	Vulnerable	9-Apr-2003
Slackware	Vulnerable	23-May-2003
Sony Corporation	Unknown	18-Feb-2003
Stonesoft	Vulnerable	21-May-2003
Sun Microsystems Inc.	Vulnerable	18-Mar-2003
SuSE Inc.	Vulnerable	28-May-2003
The SCO Group (SCO Linux)	Vulnerable	20-Mar-2003
The SCO Group (SCO UnixWare)	Vulnerable	20-Mar-2003
Top Layer Networks	Not Vulnerable	1-Apr-2003
Trustix	Vulnerable	27-Mar-2003
TurboLinux	Vulnerable	12-Aug-2003
Unisys	Unknown	18-Feb-2003
Wind River Systems Inc.	Unknown	18-Feb-2003
Wirex	Vulnerable	17-Apr-2003
Xerox Corporation	Vulnerable	9-May-2003
Xi Graphics	Unknown	18-Feb-2003

References

http://www.eeye.com/html/Research/Advisories/AD20030318.html
http://www.ietf.org/rfc/rfc1831.txt
http://www.ietf.org/rfc/rfc1832.txt

Credit

Thanks to Riley Hassell of eEye Digital Security for reporting this vulnerability.

This document was written by Chad R Dougherty and Jeffrey S Havrilla.

Other Information

Date Public:	2003-03-18
Date First Published:	2003-03-19
Date Last Updated:	2004-02-11
CERT Advisory:	CA-2003-10
CVE-ID(s):	CAN-2003-0028
NVD-ID(s):	CAN-2003-0028
US-CERT Technical Alerts:
Metric:	12.02
Document Revision:	33

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader