RedHatLinuxdump Buffer Overflow Vulnerability

Affected System: unaffected system: NetBSD

Affected Systems:

MandrakeSoft Linux Mandrake 7.0

MandrakeSoft Linux Mandrake 6.1

RedHat in Linux 6.2

RedHat in Linux 6.1

RedHat in Linux 6.0

RedHat in Linux 5.2

RedHat in Linux 5.1

Unaffected system:

NetBSD-current

Description:

In RedHat Linux, a file backup tool "dump" is installed in/sbin and set the setuid/setgid root bit. When a long string is sent to the "-f a" parameter, dump will cause stack overflow. If the provided parameters are carefully constructed, attackers may replace the EIP (command pointer or return address) stored in the stack and execute arbitrary code with the gid root permission. During crash, Dump discards the setuid root permission, but does not discard the setgid root permission. Therefore, attackers may exploit this vulnerability to obtain the setgid root permission, which in turn may gain control over the entire system.

<* Source:-Yong-jun, Kim-

E-mail: loveyou@hackerslab.org s96192@ce.hannam.ac.kr

Homepage: http://www.hackerslab.org http://ce.hannam.ac.kr /~ S96192

*>