IBM Tivoli Firewall Security Toolbox buffer overflow vulnerability

2003-03-20T00:00:00
ID SECURITYVULNS:DOC:4249
Type securityvulns
Reporter Securityvulns
Modified 2003-03-20T00:00:00

Description


Subject : IBM Tivoli Firewall Security Toolbox (TFST) remote buffer overflow vulnerability Version : Tivoli Firewall Toolbox version 1.2 Platform: All supported platforms


0o Overview

The Tivoli Firewall Toolbox is an optional component of the Tivoli management environment and provides the underlying communication for the framework-based applications within a firewall environment.

A vulnerability was discovered in the Tivoli relay daemon, which is part of this communication layer.

0o Impact

The vulnerability may allow a Tivoli endpoint to execute arbitrary code on an affected system.

0o Technical description

The TFST relay daemon, which listens on a TCP network socket, performs no bounds checking while storing data from Tivoli nodes into a memory buffer. Due to this it is possible for Tivoli nodes to cause a buffer overflow in the relay daemon.

The buffer overflow can be used to overwrite critical program control data on the stack and may therefore be used to inject malicious code in the relay daemon process. This code can then be executed with the privileges of this process.

On Unix platforms, abuse of this vulnerability can initially allow remote attackers to penetrate affected systems with user 'nobody' privileges. Due to insecure permissions on the relay.sh script, which is executed at boot time, it is possible to elevate the user 'nobody' privileges to those of the 'root' user on these systems.

It should be noted that the relay daemon, under normal circumstances, is configured to only accept connections from trusted Tivoli nodes.

0o Solution

Affected Tivoli customers should upgrade to the IBM Tivoli Firewall Toolbox version 1.3, which can be found at:

http://www-3.ibm.com/software/sysmgmt/products/support/IBMTivoliManagementFramework.html (Entitled Customers only)

ftp://ftp.software.ibm.com/software/tivoli_support/patches/patches_1.3 (anonymous access)

0o Disclaimer


All information, advice and statements are provided "AS IS", without any warranty of any kind, express or implied, including but not limited to, warranties of accuracy, timeliness, non-infringement or fitness for a particular purpose. Ubizen assumes no liability for any loss or damage whatsoever (direct, indirect, consequential or otherwise). The use of and/or reliance on any of the information, advice or statements provided will be at the sole risk of the using/relying party.

Copyright (c) 2003 by Ubizen N.V. All rights reserved. All trademarks or registered trademarks are the property of their respective owners.