CERT^® Advisory CA-1997-10 Vulnerability in Natural Language Service

A complete revision history is at the end of this file.

The CERT Coordination Center has received reports of a buffer overflow condition that affects some libraries using the Natural Language Service (NLS) on UNIX systems. By exploiting this vulnerability, any local user can execute arbitrary programs as a privileged user. There is a possibility (with some old libraries) that the vulnerability can be exploited by a remote user.

Exploitation information is publicly available.

The CERT/CC team recommends installing patches when they become available.

We will update this advisory as we receive additional information. Please check advisory files regularly for updates that relate to your site.

I. Description

A buffer overflow condition affects libraries using the Natural Language Service (NLS). The NLS is the component of UNIX systems that provides facilities for customizing the natural language formatting for the system. Examples of the types of characteristics that can be set are language, monetary symbols and delimiters, numeric delimiters, and time formats.

Some libraries that use a particular environment variable associated with the NLS contain a vulnerability in which a buffer overflow condition can be triggered. The particular environment variable involved is NLSPATH on some systems and PATH_LOCALE on others.

It is possible to exploit this vulnerability to attain unauthorized access by supplying carefully crafted arguments to programs that are owned by a privileged user-id and that have setuid or setgid bits set.

Exploit information involving this vulnerability has been made publicly available.

II. Impact

Local users (users with access to an account on the system) are able to execute arbitrary programs as a privileged user without authorization. There is a possibility (with some old libraries) that the vulnerability can be exploited by a remote user.

III. Solution

Install a patch for this problem when one becomes available. Currently, there is no workaround to use in the meantime.

Below is a list of vendors who have provided information about this problem. Details are in Appendix A of this advisory; we will update the appendix as we receive more information. If your vendor's name is not on this list, the CERT/CC did not hear from that vendor. Please contact your vendor directly.

Berkeley Software Design, Inc. (BSDI)
Cray Research - A Silicon Graphics Company
Data General Corporation
Digital Equipment Corporation
Hewlett-Packard Company
IBM Corporation
Linux Systems
NEC Corporation
NeXT/Apple
The Santa Cruz Operation (SCO)
Solbourne
Sun Microsystems, Inc.

Appendix A - Vendor Information

Berkeley Software Design, Inc. (BSDI)

Cray Research - A Silicon Graphics Company

FIX AVAILABILITY

RELATED INFORMATION

Data General Corporation

Digital Equipment Corporation

SOURCE:

This reported problem is not present for Digital's ULTRIX or Digital UNIX Operating Systems Software.

Hewlett-Packard Company

IBM Corporation

AIX 3.2.5

PTFs - U447656 U447671 U447676 U447682 U447705 U447723 (APAR IX67405)

To determine if you have these PTFs on your system, run the following command:

lslpp -lB U447656 U447671 U447676 U447682 U447705 U447723

AIX 4.1

APAR - IX67407

To determine if you have this APAR on your system, run the following command:

instfix -ik IX67407

Or run the following command:

lslpp -h bos.rte.libc

Your version of bos.rte.libc should be 4.1.5.7 or later.

AIX 4.2

APAR - IX67377 IX65693

To determine if you have these APARs on your system, run the following command:

instfix -ik IX67377 IX65693

Or run the following command:

lslpp -h bos.rte.libc

Your version of bos.rte.libc should be 4.2.0.11 or later.

(APAR IX65693 fixes a problem with the mkgroup command after IX67377 is applied.)

To Order

http://service.software.ibm.com/aixsupport/

or send e-mail to aixserv@austin.ibm.com with a subject of "FixDist".

IBM and AIX are registered trademarks of International Business Machines Corporation.

Linux Systems

linux% ldd /bin/ls

libc.so.5 => /lib/libc.so.5.3.12

This indicates the machine is using libc 5.3.12.

C libraries older than 5.3.12 (that is libc5.2.18, libc5.0.9 etc) are vulnerable to this bug and you should upgrade the C library. The release versions of libc 5.4.x are immune to this attack.

If you have libc5.3.12 it is insecure unless it is the modified libc5.3.12 shipped with Red Hat 4.1, or as an upgrade on Red Hat 4.0. You can check this with the package manager:

linux# rpm -q libc

libc-5.3.12-17

Indicates you have version 17 of the package. This is the safe one.

Red Hat 4.0 users who have not already upgraded their libc can obtain this package at

ftp://ftp.redhat.com/pub/redhat/old-releases/redhat-4.0/updates/.

NEC Corporation

NeXT/Apple

The Santa Cruz Operation (SCO)

Solbourne

Sun Microsystems, Inc.

The CERT Coordination Center staff thanks Wolfgang Ley of DFN-CERT for his input to this advisory and Bruce Ide for drawing our attention to the problem.

UPDATES

National Language Service
National Language Support
Native Language System
Natural Language Service
Natural Language Support

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

If you prefer to use DES, please call the CERT hotline for more information.

Getting security information

CERT publications and other security information are available from our web site

http://www.cert.org/

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.

Copyright 1997 Carnegie Mellon University.

Sep. 26, 1997 Updated copyright statement
June 3, 1997  Updates section - added other phrases for the the NLS acronym
              Appendix A - updated Cray Research entry.
May 1, 1997   Section III and Appendix. Updated vendor information
              for Hewlett-Packard Company.
              Acknowledgments - added a name upon receiving
              permission to do so.