|
Citadel/UX Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA9294
|
|
|
Release Date:
|
2003-07-17
|
|
Popularity:
|
5,075 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
Security Bypass
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Citadel/UX 6.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
Multiple vulnerabilities have been identified in Citadel/UX, which can be exploited by malicious people to gain high privileges, cause a DoS (Denial of Service) on a vulnerable system or compromise it.
1) The authentication token for the higher privileged "internal program" is generated in a predictable way, because the seed is based on the process id (pid). A malicious person, who is able to correctly guess the pid, may therefore be able to gain privileges as an "internal program".
2) There are some boundary errors in the functions used for importing configuration options. This can be exploited to cause a buffer overflow allowing execution of arbitrary code on the system.
Since the affected functions only can be used by an "internal program", successful exploitation requires that a person has gained these privileges (eg. by exploiting the first vulnerability).
3) Missing size restrictions of a user's biography file can be exploited to consume all available disk space.
The vulnerabilities have been reported in version 6.07. However, prior versions may also be affected.
NOTE: See original advisory for more detailed information and exploits.
Solution:
Update to version 6.08:
http://uncensored.citadel.org/pub/citadel/citadel-ux-6.08.tar.gz
Provided and/or discovered by:
Carl Livitt and br00t.
Original Advisory:
http://lists.insecure.org/lists/fulld...att-0377/CLIVITT-2003-4__Citadel_.txt
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
