Vulnerability Note VU#538033

ypxfrd daemon fails to properly validate user supplied arguments in "getdbm" procedure

Overview

A vulnerability in the ypxfrd daemon may allow a local attacker to read arbitrary files on the vulnerable system.

I. Description

Janusz Niewiadomski, of iSEC, discovered this vulnerability and produced the following advisory.

Issue: ====== Improper arguments validation in ypxfrd may allow local attacker to read any file on the system.
Description: ============ ypxfrd daemon is used for speed up the distribution of large NIS maps from NIS master to NIS slave servers.
Details: ======== When getdbm procedure is called, ypxfrd daemon creates a path to the /var/yp/domain/map file (where domain and map are arguments provided in the request). Unfortunately it fails to check if both arguments contains slash or dot characters, thus making databases outside /var/yp directory accessible. A symlink done can override .pag / .dir file extension limitation, allowing local attacker to read any file on the system.
Impact: ======= When ypxfrd is configured and running, local attacker is able to read any file on the system. It is also possible to remotely read database outside /var/yp directory, depending on the securenets configuration.

II. Impact

A local attacker my be able to read any file on the vulnerable system. This may lead to privilege escalation.

III. Solution

Apply a patch.

Systems Affected

Vendor	Status	Date Updated
Apple Computer Inc.	Not Vulnerable	3-Sep-2002
BSDI	Unknown	29-Aug-2002
Conectiva	Unknown	29-Aug-2002
Cray Inc.	Not Vulnerable	4-Sep-2002
Data General	Unknown	29-Aug-2002
Debian	Not Vulnerable	30-Oct-2002
FreeBSD	Not Vulnerable	18-Sep-2002
Fujitsu	Unknown	29-Aug-2002
Guardian Digital Inc.	Unknown	29-Aug-2002
Hewlett-Packard Company	Unknown	29-Aug-2002
IBM	Vulnerable	10-Oct-2002
MandrakeSoft	Not Vulnerable	11-Oct-2002
MontaVista Software	Unknown	29-Aug-2002
NEC Corporation	Not Vulnerable	24-Sep-2002
NetBSD	Unknown	29-Aug-2002
NeXT	Unknown	29-Aug-2002
OpenBSD	Not Vulnerable	5-Sep-2002
Openwall GNU/*/Linux	Unknown	29-Aug-2002
Red Hat Inc.	Not Vulnerable	29-Aug-2002
Sequent	Unknown	29-Aug-2002
SGI	Not Vulnerable	29-Aug-2002
Sony Corporation	Unknown	29-Aug-2002
Sun Microsystems Inc.	Vulnerable	10-Oct-2002
SuSE Inc.	Not Vulnerable	29-Aug-2002
The SCO Group (SCO UnixWare)	Vulnerable	18-Sep-2002
Unisys	Unknown	29-Aug-2002
Wind River Systems Inc.	Unknown	29-Aug-2002

References

http://isec.pl/vulnerabilities/0006.txt
http://isec.pl/

Credit

Thanks to Janusz Niewiadomski for reporting this vulnerability. We also thank Sun Microsystems for their assistance.

This document was written by Ian A Finlay.

Other Information

Date Public	10/09/2002
Date First Published	10/10/2002 01:46:11 PM
Date Last Updated	04/09/2003
CERT Advisory
CVE-ID(s)	CAN-2002-1199
NVD-ID(s)	CAN-2002-1199
US-CERT Technical Alerts
Metric	4.50
Document Revision	7

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader