Digital Unix MSGCHK Buffer Overflow Vulnerability

The msgchk utility under certain versions of Digital Unix contains a buffer overflow vulnerability which could yield root privilege.

If a local user invokes the msgchk utility at the command line, argumented with a sufficiently long string of bytes, a buffer overflow condition can be triggered. Where msgchk runs suid root, this can allow hostile code to be executed as root, granting an attacker administrative access to the vulnerable system.

L33tdawg: The list of vulnerable machines as well as the fix for the problem is attached. bugtraq id 3311
object msgchk (exec)
class Boundary Condition Error
cve CVE-MAP-NOMATCH
remote No
local Yes
published September 10, 2001
updated September 10, 2001
vulnerable Digital (Compaq) TRU64/DIGITAL UNIX 4.0g
Digital (Compaq) TRU64/DIGITAL UNIX 4.0f
Digital (Compaq) TRU64/DIGITAL UNIX 4.0e
Digital (Compaq) TRU64/DIGITAL UNIX 4.0d

Solution: Temporary workaround: Unless msgchk must be run suid, (ie for support of "rpop"), strip the suid bit (chmod u-s /usr/bin/mh/msgchk)