CVE-1999-0674

Vulnerability

The profil(2) system call, present in older Unix versions and some BSD systems, allows a process to sample its program counter (PC) and increment an array element on each profile clock tick. The vulnerability arises because profiling is not disabled when a process uses execve(2) to execute a new program image. This allows a local user to control the size and location of the profiling array and scale factor, potentially arranging for an arbitrary 16-bit virtual address to be incremented. Affected systems include NetBSD 1.4, OpenBSD 2.5, and Solaris 7.0 [1].

Exploitation

An attacker with local access and knowledge of memory addresses used by privileged programs could construct an exploit. The profil(2) system call allows an attacker to arrange for an arbitrary 16-bit program virtual address to be incremented on each profile clock tick. If a program stores system call results in memory locations, this mechanism could theoretically alter the outcome of security-related system calls or library functions by changing values like -1 to 0 or 0 to 1 [1].

Impact

While unlikely, it is theoretically possible for an attacker to modify the internal data space of a program. This could lead to security failures if critical values, such as return codes from system calls, are stored in memory locations that are also used by the profiling array. The attacker could potentially turn a success into a failure or vice versa, impacting the program's security behavior [1].

Mitigation

It is recommended to upgrade to patched versions of the affected operating systems. Specific patched versions and release dates are not detailed in the available references. Some systems, like Solaris, may have partial fixes that do not disable profiling unless the new image is owned by a different user. No workarounds or EOL status are disclosed in the provided references [1].