Format string vulnerability in AIX(r) locale subsystem.

[IGS ERS Advisory Service/Charlotte/IBM <advisory () US IBM COM>]

-----BEGIN PGP SIGNED MESSAGE-----

- ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL
RELEASE---

                                      IBM
                           EMERGENCY RESPONSE SERVICE
                              FOR YOUR INFORMATION

25 OCT 2000 22:40 GMT                            Number:
ERS-FYI-E01-2000:078.1
===============================================================================
                 THIS IS NOT A SECURITY VULNERABILITY ALERT

IBM-ERS For Your Information (FYI) documents are designed to provide
customers
of the IBM Emergency Response Service with information about current topics
in
the fields of Internet and virus security.  FYI documents will be issued
periodically as the need arises.  Topics may include security implications
of
new protocols in use on the Internet, implementation suggestions for
certain
types of services, virus hype and hoaxes, and answers to frequently asked
questions.

===============================================================================
                                TODAY'S  TOPIC

              Format string vulnerability in AIX(r) locale subsystem.

                                   CONTENTS

  I. DESCRIPTION
 II. IMPACT
III. SOLUTIONS
 IV. OBTAINING FIXES
  v. ACKNOWLEDGEMENTS
 VI. CONTACT INFORMATION

===========================================================================

                           VULNERABILITY SUMMARY

VULNERABILITY:    Format string vulnerability in AIX(r) locale subsystem.

PLATFORMS:        IBM AIX 3.2.x, 4.1.x, 4.2.x, 4.3.x

SOLUTION:         Apply the fixes listed below.

THREAT:           Local users can gain root access.

CVE candidate:    CAN-2000-0844

===========================================================================
                           DETAILED INFORMATION

I.  Description

AIX allows user specified locale file to be used for displaying
messages. This functionality is provided through the catopen() call.
This call uses the NLSPATH environment variable to specify an alternate
locale file instead of one of the system locale files. By constructing
a valid locale file which contains special format characters and
setting the NLSPATH environment variable to point to its path, a
malicious user can have privileged applications use his locale file to
obtain root privileges.


II.  Impact

Any executable with the setuid or setgid bit set is potentially
vulnerable to root compromise.


II.  Solutions

  A.  Official fix

      IBM is working on the following fix which will be available
      soon:

      AIX 4.3.x:  IY13753

      NOTE: Fix will not be provided for versions prior to 4.3 as
      these are no longer supported by IBM. Affected customers are
      urged to upgrade to 4.3, or higher.

  B.  How to minimize the vulnerability

    A temporary fix for AIX 4.3.x systems is available which ignores
    the NLSPATH environment variable.  Note that pending standards
    compliance review, the actual APAR fix may or may not be
    implemented the same way. The temporary fix can be downloaded
    via ftp from:

    ftp://aix.software.ibm.com/aix/efixes/security/locale_format_efix.tar.Z

    The MD5 checksum for the efix libc is:

    Filename        sum             md5
    =================================================================
    libc.a          12878  6149     f8169a0c985220874c0404b4c69d5f20


    This temporary fix has not been fully regression tested. Do the
    following steps (as root) to install the temporary fix:

    1.  Determine the version of the libc fileset on your machine.

        # lslpp -l bos.rte.libc

        If the version of the libc.a fileset for your machine is not
        at the level given below, install the requisite APAR
        listed. This will help ensure that the libc fix will run
        properly.

        Release        Fileset       Version        requisite APAR
        ============================================================
        AIX 4.3.x      bos.rte.libc  4.3.3.25       IY12541

    2. Uncompress and extract the fix.

        a. place the temporary fix in a directory of your choosing, e.g.,
"your_dir";
           using /tmp as your_dir is a reasonable choice
        b. # uncompress < locale_format_efix.tar.Z | tar xf -

        The efix libc.a will be extracted to your_dir/locale_format/lib

    3. Make sure the new libc.a works on your system.

        a. # slibclean
        b. # export LIBPATH=your_dir/locale_format/lib
        c. # ls your_dir

        NOTE: This "ls" is a simple test to make sure the new libc.a works.
        If this does *NOT* work (i.e. you get a "killed" message), then do
        *NOT* go further...this libc.a does not work on your system.

    4. Follow the instructions below to install the new libc.a.

        Make a copy of the original libc.a (make sure there is enough
        free apace in the filesystem to for you to work with), e.g.,

          a. # mkdir /usr/ccs/lib/sv
          b. # cp /usr/ccs/lib/libc.a /usr/ccs/lib/sv

        Copy the libc.a fix into place, e.g.,

          a. # cp -f your_dir/locale_format/lib/libc.a /usr/ccs/lib/
          b. # chown bin.bin /usr/ccs/lib/libc.a
          c. # chmod 555 /usr/ccs/lib/libc.a
          d. # ln -sf /usr/ccs/lib/libc.a /usr/lib/libs.a
          e. # unset LIBPATH
          f. # slibclean

        Make sure that the new libraries will be picked up at
        the next reboot.

          # bosboot -a

    4. Reboot.


IV. Obtaining Fixes

IBM AIX APARs may be ordered using Electronic Fix Distribution (via the
FixDist program), or from the IBM Support Center.  For more information
on FixDist, and to obtain fixes via the Internet, please reference

        http://techsupport.services.ibm.com/rs6k/fixes.html

or send email to "aixserv () austin ibm com" with the word "FixDist" in the
"Subject:" line.

To facilitate ease of ordering all security related APARs for each AIX
release, security fixes are periodically bundled into a cumulative APAR.
For more information on these cumulative APARs including last update and
list of individual fixes, send email to "aixserv () austin ibm com" with
the word "subscribe Security_APARs" in the "Subject:" line.


V.  Acknowledgements

Thanks to Ivan Arce of CORE-SDI for bringing this vulnerability to
our attention.


VI.  Contact Information

Comments regarding the content of this announcement can be directed to:

   security-alert () austin ibm com

To request the PGP public key that can be used to encrypt new AIX
security vulnerabilities, send email to security-alert () austin ibm com
with a subject of "get key".

If you would like to subscribe to the AIX security newsletter, send a
note to aixserv () austin ibm com with a subject of "subscribe Security".
To cancel your subscription, use a subject of "unsubscribe Security".
To see a list of other available subscriptions, use a subject of
"help".

IBM and AIX are a registered trademark of International Business
Machines Corporation.  All other trademarks are property of their
respective holders.

===============================================================================

IBM's Internet Emergency Response Service (IBM-ERS) is a subscription-based
Internet security response service that includes computer security incident
response and management, regular electronic verification of your Internet
gateway(s), and security vulnerability alerts similar to this one that are
tailored to your specific computing environment.  IBM's Virus Emergency
Response Service is a subscription-based service that provides assistance
with virus risk and emergency management.  By acting as an extension of
your
own internal security staff, IBM-ERS's team of security experts helps you
quickly detect and respond to attacks and exposures to your I/T
infrastructre.

As a part of IBM's Business Continuity Recovery Services organization, the
IBM Emergency Response Service is a component of IBM's SecureWay(tm)
line of security products and services.  From hardware to software to
consulting, SecureWay solutions can give you the assurance and expertise
you
need to protect your valuable business resources.  To find out more about
the
IBM Emergency Response Service, send an electronic mail message to
ers-sales () ers ibm com, or call 1-800-426-7378.

IBM-ERS maintains a site on the World Wide Web at http://www.ers.ibm.com/.
Visit the site for information about the service, copies of security
alerts,
team contact information, and other items.

IBM-ERS uses Pretty Good Privacy* (PGP*) as the digital signature mechanism
for
security vulnerability alerts and other distributed information.  The
IBM-ERS
PGP* public key is available from
http://www.ers.ibm.com/team-info/pgpkey.html.
"Pretty Good Privacy" and "PGP" are trademarks of Philip Zimmermann.

IBM-ERS is a Member Team of the Forum of Incident Response and Security
Teams
(FIRST), a global organization established to foster cooperation and
response
coordination among computer security teams worldwide.

Copyright 2000 International Business Machines Corporation.

The information in this document is provided as a service to customers of
the IBM Emergency Response Service.  Neither International Business
Machines
Corporation, nor any of its employees, makes any warranty, express or
implied,
or assumes any legal liability or responsibility for the accuracy,
complete-
ness, or usefulness of any information, apparatus, product, or process
contained herein, or represents that its use would not infringe any
privately
owned rights.  Reference herein to any specific commercial products,
process,
or service by trade name, trademark, manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation or favoring
by IBM or its subsidiaries.  The views and opinions of authors expressed
herein do not necessarily state or reflect those of IBM or its
subsidiaries,
and may not be used for advertising or product endorsement purposes.

The material in this document may be reproduced and distributed, without
permission, in whole or in part, by other security incident response teams
(both commercial and non-commercial), provided the above copyright is kept
intact and due credit is given to IBM-ERS.

This document may be reproduced and distributed, without permission, in its
entirety only, by any person provided such reproduction and/or distribution
is performed for non-commercial purposes and with the intent of increasing
the awareness of the Internet community.

- ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL
RELEASE---

-----BEGIN PGP SIGNATURE-----
Version: 2.7.1

iQCVAwUBOfditPWDLGpfj4rlAQEWXgP/XZ4Ry7gX77SHBfy1nEvpNb2YGq/aRf+s
ow8iZGJKPFX6b+cP7fJaMFW+gPlSpy54VpktAdmCIfaF4cg1oEQKhQj9s2IAmqop
qeY13jjTVkBoDbIjQjdcRMngAMxKcyjHotmbKfMr3mRZL/yIZRZxWJQ0+az9FKON
LMABsUXQn7U=
=TERd
-----END PGP SIGNATURE-----