Michael Ligh and Greg Sinclair have reported some vulnerabilities in Symark PowerBroker, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerabilities are caused due to boundary errors within the pbrun, pbsh, and pbksh SUID binaries. These can be exploited to cause stack-based buffer overflows by executing the vulnerable binaries with an overly long "argv[0]" string.

The vulnerabilities are reported in versions 2.8 through 5.0.1.

Solution
Apply vendor service packs (see vendor advisory for details).

Provided and/or discovered by
Michael Ligh of MNIN.org and Greg Sinclair of NNL-Labs.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Symark:
http://www.symark.com/support/PBFeb2008Announcement.html

Michael Ligh and Greg Sinclair:
http://www.mnin.org/advisories/2008_symarkpb.pdf

Deep Links
Links available to Secunia VIM customers