Buffer overflow in HylaFAX faxgetty before 4.1.3 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long line of image data.

A set of problems have been discovered in Hylafax, a flexible client/server fax software distributed with many GNU/Linux distributions. Quoting SecurityFocus the problems are in detail :

  - A format string vulnerability makes it possible for     users to potentially execute arbitrary code on some     implementations. Due to insufficient checking of input,     it's possible to execute a format string attack. Since     this only affects systems with the faxrm and faxalter     programs installed setuid, Debian is not vulnerable.
  - A buffer overflow has been reported in Hylafax. A     malicious fax transmission may include a long scan line     that will overflow a memory buffer, corrupting adjacent     memory. An exploit may result in a denial of service     condition, or possibly the execution of arbitrary code     with root privileges.

  - A format string vulnerability has been discovered in     faxgetty. Incoming fax messages include a Transmitting     Subscriber Identification (TSI) string, used to identify     the sending fax machine. Hylafax uses this data as part     of a format string without properly sanitizing the     input. Malicious fax data may cause the server to crash,     resulting in a denial of service condition.

  - Marcin Dawcewicz discovered a format string     vulnerability in hfaxd, which will crash hfaxd under     certain circumstances. Since Debian doesn't have hfaxd     installed setuid root, this problem cannot directly lead     into a vulnerability. This has been fixed by Darren     Nickerson, which was already present in newer versions,     but not in the potato version.

These problems have been fixed in version 4.0.2-14.3 for the old stable distribution (potato), in version 4.1.1-1.1 for the current stable distribution (woody) and in version 4.1.2-2.1 for the unstable distribution (sid).

Numerous vulnerabilities in the HylaFAX product exist in versions prior to 4.1.3. It does not check the TSI string which is received from remote FAX systems before using it in logging and other places. A remote sender using a specially formatted TSI string can cause the faxgetty program to segfault, resulting in a denial of service. Format string vulnerabilities were also discovered by Christer Oberg, which exist in a number of utilities bundled with HylaFax, such as faxrm, faxalter, faxstat, sendfax, sendpage, and faxwatch. If any of these tools are setuid, they could be used to elevate system privileges.
Mandrake Linux does not, by default, install these tools setuid.
Finally, Lee Howard discovered that faxgetty would segfault due to a buffer overflow after receiving a very large line of image data. This vulnerability could conceivably be used to execute arbitrary commands on the system as root, and could also be exploited more easily as a denial of sevice.

The remote host is missing the patch for the advisory SUSE-SA:2002:035 (hylafax).


HylaFAX is a client-server architecture for receiving and sending facsimiles.

The logging function of faxgetty prior version 4.1.3 was vulnerable to a format string bug when handling the TSI value of a received facsimile.
This bug could easily be used to trigger a denial-of-service attack or to execute arbitrary code remotely.

Another bug in faxgetty, a buffer overflow, can be abused by a remote attacker by sending a large line of image data to execute arbitrary commands too.

Several format string bugs in local helper applications were fixed too.
These bugs can not be exploited to gain higher privileges on a system running SUSE LINUX because of the absence of setuid bits.

The hylafax package is not installed by default.
A temporary fix is not known.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

ID	Name	Product	Family	Severity
14985	Debian DSA-148-1 : hylafax - buffer overflows and format string vulnerabilities	Nessus	Debian Local Security Checks	high
13957	Mandrake Linux Security Advisory : hylafax (MDKSA-2002:055)	Nessus	Mandriva Local Security Checks	high
13756	SUSE-SA:2002:035: hylafax	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2002-1050

critical

Tenable Plugins

high

high

high