[12413] in bugtraq
Some holes for Win/UNIX softwares
daemon@ATHENA.MIT.EDU (UNYUN)
Tue Nov 2 14:05:07 1999
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Message-Id: <381EE9AC140.6668SHADOWPENGUIN@fox.nightland.net>
Date: Tue, 2 Nov 1999 22:39:56 +0900
Reply-To: UNYUN <shadowpenguin@BACKSECTION.NET>
From: UNYUN <shadowpenguin@BACKSECTION.NET>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Hello,
We found security problems on some softwares for UNIX and Windows9*/NT.
This is a detailed report about such security problems.
The following problems are from the posts of BUGTRAQ-JP (they are
written in Japanese), but there are some requests, so I post to BUGTRAQ.
vender software version exploitabled
-----------------------------------------------------------
1 YAMAHA YAMAHA MidiPlug 1.10b IE4/5 Windows98J
2 BTD STUDIO ZOM-MAIL 1.09 Windows98J
3 AN-HTTPd 1.20b Windows98J
4 IBM HomePagePrint 1.0.7 Windows98J
5 uum 4.2 Turbo Linux3J
6 canuum 3.5b2 Turbo Linux3J
(1) YAMAHA MidiPlug 1.10b
Problem:
Midi-Plugin program "YAMAHA MidiPlug 1.10b-j" for Windows IE4/5
contains the buffer overflow bug. If the long "TEXT" variable is
specified in EMBED tag, the buffer overflow occurs. If attacker sets the
exploit on the webpage, visitor's host will be cracked by the any
instructions written in the "TEXT" variable.
Solution:
If the check of "execution of active X controle and plugin" is turned to
"invalid", you can avoid this problem. "Display dialog box mode" is also
vulnerable. The overflow occurs without the dialog box warning, if the
opening file is stored in local disk and it is opened.
Exploit:
http://shadowpenguin.backsection.net/toolbox.html#no051
This exploit generates a html file that contains the exploit. The html
file executes "c:\windows\welcome.exe" on the victim host. This is
tested on Windows98(Japanese).
(2) BTD STUDIO ZOM-MAIL 1.09
Problem:
Internet Mailer "ZOM-MAIL 1.09" for Windows contains the buffer overflow
bug. If the long attachment file name is contained in the recived mail, the
buffer overflow occurs when ZOM-MAIL pops such mail from pop server. If
attacker sets the exploit in the filename, user's host will be cracked
by the any instructions written in the filename area.
Solution:
Before you pop your mail by ZOM-MAIL, you check your mail by using other
mailer that don't contain same bug.
Exploit:
http://shadowpenguin.backsection.net/toolbox.html#no050
This exploit removes a file "c:\\windows\\test.txt". This is tested on
Windows98(Japanese)
(3) AN-HTTPd 1.20b
Problem:
The test CGIs which are distributed with AN-HTTPd 1.20b contain the
remote command execution problem.
Solution:
[1] remove the following test CGIs.
cgi-bin/test.bat
cgi-bin/input.bat
cgi-bin/input2.bat
ssi/envout.bat
[2] Ver1.21 has been released at the official site.
http://www.st.rim.or.jp/~nakata/
Exploit:
(example)
http://www.xxx.yy/cgi-bin/input.bat?|dir..\..\windows
(4) IBM HomePagePrint 1.0.7
Problem:
Web page printout software "IBM HomePagePrint 1.0.7" contains the buffer
overflow bug. If the long string is specified in IMG_SRC tag, the buffer
overflow occurs. If attacker sets the exploit on the webpage, visitor's
host will be cracked by the any instructions written in the IMG_SRC tag.
Solution:
Patch can be download at:
http://www.ibm.co.jp/software/internet/hpgprt/down2.html
Exploit:
http://shadowpenguin.backsection.net/toolbox.html#no045
This exploit execute "c:\windows\notepad.exe" on the victim host. This
is tested on Windows98(Japanese).
(5) uum
Problem:
This is a suid program which is installed many kind of UNIXs for Japanese
edition with default. It overflows if the long argment is specified with
-D option, the local user can obtain root privilege.
Exploit:
http://shadowpenguin.backsection.net/toolbox.html#no046
This exploit is for Turbo Linux3, the local user can obtain a root
privilege. We also confirmed this overflow on the following UNIXs.
Solaris 2.6,2.7, IRIX 5.3,6.2,6.3,6.4,6.5
(uum is installed with default)
In other case, we can not check.
(6) canuum
Problem:
This is a suid program which is installed some Linux distributions for
Japanese edition with default. It overflows if the long argment is
specified with some option specifications such as -k,-c,-n, the local
user can obtain root privilege.
Exploit:
http://shadowpenguin.backsection.net/toolbox.html#no047
This exploit is for Turbo Linux3, the local user can obtain a root
privilege.
-----
UNYUN
% The Shadow Penguin Security [ http://shadowpenguin.backsection.net ]
shadowpenguin@backsection.net (webmaster)
% eEye Digital Security Team [ http://www.eEye.com ]
unyun@eEye.com
