Vulnerability Note VU#877811

Buffer overflow vulnerability in pwck command line utility

Overview

The CERT/CC has received a public report of a local buffer overflow vulnerability in the pwck utility.

I. Description

The pwck utility performs syntax checking of /etc/password and /etc/shadow password information files. This utility contains a buffer overflow vulnerability in the section of code that parses command line arguments. By sending a command line argument string of approximately 3000 characters, it is possible to cause this utility to generate a segmentation fault. On systems where this utility is installed with setuid root privileges, it may be possible for local users to exploit this vulnerability to execute arbitrary code with superuser privileges.

This vulnerability has been reported to affect systems running IRIX and Linux, but other operating systems that include this setuid root utility are likely to be affected.

II. Impact

This vulnerability may allow a local user to execute arbitrary code with superuser privileges.

III. Solution

The CERT/CC is currently unaware of a practical solution to this problem.

Clear the setuid bit of affected binaries

As a workaround, it is possible to limit the scope of this vulnerability by clearing the setuid bit of affected binaries with the chmod utility.

Systems Affected

Vendor	Status	Date Notified
Apple Computer Inc.	Unknown	4-Jan-2002
BSDI	Unknown	4-Jan-2002
Caldera	Not Vulnerable	7-Jan-2002
Compaq Computer Corporation	Unknown	4-Jan-2002
Conectiva	Not Vulnerable	3-Jun-2002
Data General	Unknown	4-Jan-2002
Debian	Unknown	4-Jan-2002
FreeBSD	Not Vulnerable	24-Jan-2002
Fujitsu	Not Vulnerable	24-Jan-2002
Hewlett Packard	Not Vulnerable	24-Jan-2002
IBM	Not Vulnerable	9-Jan-2002
MandrakeSoft	Unknown	4-Jan-2002
NEC Corporation	Unknown	4-Jan-2002
NetBSD	Not Vulnerable	7-Jan-2002
OpenBSD	Unknown	4-Jan-2002
Openwall	Not Vulnerable	5-Jul-2002
Red Hat Inc.	Not Vulnerable	8-Jan-2002
SGI	Not Vulnerable	7-Jan-2002
Sony Corporation	Unknown	4-Jan-2002
Sun Microsystems Inc.	Not Vulnerable	7-Jan-2002
Unisys	Unknown	4-Jan-2002

References

VU#121891
http://www.linux.com/develop/man/8/pwck/
http://www.securityfocus.com/archive/82/247920
http://www.kb.cert.org/vuls/id/121891

Credit

This vulnerability was reported to several SecurityFocus mailing lists on 01/02/2002 by blackshell@hushmail.com.

This document was written by Jeffrey P. Lanza.

Other Information

Date Public:	2002-01-02
Date First Published:	2002-01-04
Date Last Updated:	2002-07-05
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Severity Metric:	10.69
Document Revision:	19

If you have feedback, comments, or additional information about this vulnerability, please send us email.