Cobalt RaQ Vulnerabilities

Updated 12/12/02
CAN 2002-0346
CAN 2002-0347
CAN 2002-0348
CAN 2002-1361

Impact

A remote attacker may be able to gain unauthorized read access to sensitive files, crash the server, or implement a cross-site scripting attack. If the Security Hardening Package is installed, it may also be possible to run arbitrary commands.

Note: The red stoplight on this page indicates the highest possible severity level for this category of vulnerabilities. To determine the severity level in this instance, refer to the colored dot beside the link to this tutorial on the previous page.

Background

Cobalt RaQ is a server appliance for Internet Service Providers. It can provide web, FTP, and e-mail services for up to 200 sites, and fits into a standard rack. Many Cobalt RaQ users install Sun's Security Hardening Package, which is intended to provide additional buffer overflow protection, root privilege control, and other security features.

The Problems

Security Hardening Package overflow.cgi buffer overflow

12/12/02
CAN 2002-1361
The overflow.cgi script, which is included with the Cobalt RaQ 4 Security Hardening Package, contains a remotely exploitable buffer overflow condition in the processing of the email parameter. An attacker could execute arbitrary commands by sending specially crafted POST commands.

Directory Traversal File Access

3/6/02
CAN 2002-0347
By requesting a web address containing the dot-dot-slash (../) sequence, it is possible for a remote attacker to view files under the web root that would otherwise not be readable, such as .htaccess files.

Cross-site Scripting in CGI Scripts

3/6/02
CAN 2002-0346
Two CGI scripts, alert.cgi and service.cgi, do not properly handle malformed parameters containing script tags. A malicious web site could induce visitors to run arbitrary scripts on their workstations by setting up a specially crafted link to the vulnerable CGIs. Although cross-site scripting does not result in a compromise of the vulnerable server itself, it is undesirable because it facilitates an attack on other machines.

Denial of Service in CGI Scripts

3/6/02
CAN 2002-0348
Two CGI scripts, alert.cgi and service.cgi, do not properly handle very long input parameters. A remote attacker could crash the service, requiring an administrator to manually restart it.

Resolutions

A workaround for the alert.cgi and service.cgi vulnerabilities is to remove execute permissions from the scripts, or to implement the changes described in Bugtraq. The overflow.cgi vulnerability can be fixed by removing the Security Hardening Package using the tool referenced in Sun Alert 49377.

For the directory traversal problem, a workaround is to create the file /usr/admserv/html/.htaccess containing the following text: 

<Files .htaccess>
Order allow,deny
Deny from all
</Files>
Note that this workaround only prevents access to .htaccess files. If there are other known sensitive files that should not be readable, they also need to be protected in a similar manner.

Where can I read more about this?

The vulnerability in the Security Hardening Package was reported in CERT Advisory 2002-35 and Sun Alert 49377.

The other three vulnerabilities were posted to Bugtraq.