There is a vulnerability in a Sun Microsystems Inc. code library that enables a remote attacker to execute code on a users machine.
The flaw also affects libraries derived from the Sun library, including any BSD-derived libraries with XDR/RPC routines and the GNU C Library with sunrpc.
The vulnerability is located in the Sun Network Services Library, which enables developers to incorporate XDR (External Data Representation) into their applications. XDR is a standard for the description and encoding of data and is used to transfer data between computers with different architectures.
Researchers at eEye Digital Security Inc. discovered an integer overflow in the xdrmem_getbytes () function. Depending on the location and use of the vulnerable routine, an attacker may be able to exploit this vulnerability remotely.
Although eEye, based in Aliso Viejo, Calif., just released its advisory on this vulnerability Wednesday, the bulletin was leaked to a security mailing list over the weekend, giving attackers a head start.
Sun, based in Santa Clara, Calif., has not yet produced a patch for this issue, which affects Solaris 2.6, 7, 8 and 9. IBMs AIX 4.3.3, 5.1 and 5.2 are all vulnerable, and the company has made patches available through its support organization. Version 2.3.1 of the GNU C Library is also vulnerable, as are some older versions. Patches for each version are available on the Red Hat Inc. Web site.
Other vendors, including Cray Inc. and Hewlett-Packard Co., are investigating whether their products are affected.
Most Recent Security Stories:
Search for more stories by Dennis Fisher.
Find white papers on security.
For more security news, check out Ziff Davis Medias Security Supersite.