SAS SASTCPD本地命令行缓冲区溢出漏洞-一一网

漏洞信息详情

SAS SASTCPD本地命令行缓冲区溢出漏洞

CNNVD编号：CNNVD-200205-008

危害等级：高危
CVE编号：
CVE-2002-0219
漏洞类型：

边界条件错误
发布时间：

2002-01-29
威胁类型：

本地
更新时间：

2005-10-20
厂商：

sas
漏洞来源：
Wodahs Latigid※ wo…

漏洞简介

SAS Software提供了对数据分析、报告生成、企业级的信息传递的工具和解决方案，软件有Unix、Linux及Windows下的版本。sastcpd是SAS Software软件架构中的任务生成程序。
sastcpd程序存在输入验证漏洞，可以使本地攻击者通过溢出攻击得到主机的管理员权限。
当sastcpd处理一个长约1200字节的命令行参数时，就会发生缓冲区溢出，导致堆栈变量重写执行攻击者指定的任意指令。因为sastcpd一般是以suid root安装的，指令将以root的身份被执行。

漏洞公告

临时解决方法：
如果您不能立刻安装补丁或者升级，CNNVD建议您采取以下措施以降低威胁：

* 暂时去掉sastcpd程序的suid root位，可以使用如下命令：

# chmod a-s sastcpd
厂商补丁：
SAS Software
————
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

SAS Base 8.0:

SAS Hotfix 82ba10os.exe

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/mvs/82ba10os.exe” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/mvs/82ba10os.exe

OS/390 Platform

SAS Hotfix 82ba10cm.vmarc

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/cms/82ba10cm.vmarc” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/cms/82ba10cm.vmarc

CMS Platform

SAS Hotfix 82ba10wn.exe

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/win/82ba10wn.exe” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/win/82ba10wn.exe

Windows Platform

SAS Hotfix 82ba10o2.exe

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/os2/82ba10o2.exe” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/os2/82ba10o2.exe

OS/2 Platform

SAS Hotfix 82ba10av.zip

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/alp/82ba10av.zip” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/alp/82ba10av.zip

OpenVMS Alpha Platform

SAS Hotfix 82ba10vm.zip

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/vax/82ba10vm.zip” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/vax/82ba10vm.zip

OpenVMS VAX Platform

SAS Hotfix 82ba10s2.tar

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/slx/82ba10s2.tar” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/slx/82ba10s2.tar

Solaris Platform

SAS Hotfix 82ba10s6.tar

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/s64/82ba10s6.tar” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/s64/82ba10s6.tar

Solaris 64bit Platform

SAS Hotfix 82ba10h8.tar

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/h8x/82ba10h8.tar” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/h8x/82ba10h8.tar

HP-UX Platform

SAS Hotfix 82ba10h6.tar

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/h64/82ba10h6.tar” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/h64/82ba10h6.tar

HP-UX 64bit Platform

SAS Hotfix 82ba10ar.tar

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/r6x/82ba10ar.tar” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/r6x/82ba10ar.tar

AIX Platform

SAS Hotfix 82ba10r6.tar

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/r64/82ba10r6.tar” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/r64/82ba10r6.tar

AIX 64bit Platform

SAS Hotfix 82ba10ap.tar

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/alx/82ba10ap.tar” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/alx/82ba10ap.tar

Tru64 Platform

SAS Hotfix 82ba10lx.tar

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/lnx/82ba10lx.tar” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/lnx/82ba10lx.tar

Linux Platform

SAS Hotfix 82ba10sg.tar

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/sgi/82ba10sg.tar” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/sgi/82ba10sg.tar

IRIX Platform

SAS Hotfix 82ba10ia.tar

http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/iab/82ba10ia.tar” target=”_blank”>
http://ftp.sas.com/techsup/download/hotfix/v82/base/82ba10/iab/82ba10ia.tar

ABI+ Intel Platform

SAS Integration Technologies 8.0:

SAS Integration Technologies 8.1:

SAS Base 8.1: