-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: ucd-snmp remote heap overflow Advisory number: CSSA-2003-029.0 Issue date: 2003 October 29 Cross reference: sr883603 fz528212 erg712406 CAN-2002-1570 ______________________________________________________________________________ 1. Problem Description ucd-snmp is a set of tools relating to the Simple Network Management Protocol (SNMP), which is used for remote administration and monitoring of network devices and services. Juan M. de la Torre found a remote heap overflow vulnerability in snmpnetstat (a tool used to retrieve information about a remote host). When a list of interfaces is requested, a malicious server can return information in a way that will cause a heap overflow in snmpnetstat. A remote atacker able to control a snmp server can exploit this vulnerability to execute arbitrary code with the privileges of the user running snmpnetstat. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following name CAN-2002-1570 to this issue. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to ucd-snmp-4.2.1-18.i386.rpm prior to ucd-snmp-devel-4.2.1-18.i386.rpm prior to ucd-snmp-tkmib-4.2.1-18.i386.rpm prior to ucd-snmp-utils-4.2.1-18.i386.rpm OpenLinux 3.1.1 Workstation prior to ucd-snmp-4.2.1-18.i386.rpm prior to ucd-snmp-devel-4.2.1-18.i386.rpm prior to ucd-snmp-tkmib-4.2.1-18.i386.rpm prior to ucd-snmp-utils-4.2.1-18.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-029.0/RPMS 4.2 Packages 126ee06bd94f366289364150ed7d87fb ucd-snmp-4.2.1-18.i386.rpm 6653905d5244636d0a699c48d447d627 ucd-snmp-devel-4.2.1-18.i386.rpm 947bf938d44ea9d03a5d2d242244855c ucd-snmp-tkmib-4.2.1-18.i386.rpm ec04d382fd0010911277e7635b2312b7 ucd-snmp-utils-4.2.1-18.i386.rpm 4.3 Installation rpm -Fvh ucd-snmp-4.2.1-18.i386.rpm rpm -Fvh ucd-snmp-devel-4.2.1-18.i386.rpm rpm -Fvh ucd-snmp-tkmib-4.2.1-18.i386.rpm rpm -Fvh ucd-snmp-utils-4.2.1-18.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-029.0/SRPMS 4.5 Source Packages adcdbf58ba2b5ef0075c46fcc80dc399 ucd-snmp-4.2.1-18.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-029.0/RPMS 5.2 Packages 126ee06bd94f366289364150ed7d87fb ucd-snmp-4.2.1-18.i386.rpm 6653905d5244636d0a699c48d447d627 ucd-snmp-devel-4.2.1-18.i386.rpm 947bf938d44ea9d03a5d2d242244855c ucd-snmp-tkmib-4.2.1-18.i386.rpm ec04d382fd0010911277e7635b2312b7 ucd-snmp-utils-4.2.1-18.i386.rpm 5.3 Installation rpm -Fvh ucd-snmp-4.2.1-18.i386.rpm rpm -Fvh ucd-snmp-devel-4.2.1-18.i386.rpm rpm -Fvh ucd-snmp-tkmib-4.2.1-18.i386.rpm rpm -Fvh ucd-snmp-utils-4.2.1-18.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-029.0/SRPMS 5.5 Source Packages adcdbf58ba2b5ef0075c46fcc80dc399 ucd-snmp-4.2.1-18.src.rpm 6. References Specific references for this advisory: http://www.securityfocus.com/archive/1/248141 http://www.securityfocus.com/bid/3780 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1570 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr883603 fz528212 erg712406. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO would like to thank Juan M. de la Torre and Axioma Security Research for discovering and researching this vulnerability. ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (SCO/UNIX_SVR5) iD8DBQE/oXqabluZssSXDTERAv60AJ9Z/JBd2k+kKAS0hJBhWZYuXzZqegCfbWfz qrnqLWysrI5p5LHmi4u8Aeo= =xc81 -----END PGP SIGNATURE-----