[33296] in bugtraq
----------========== OPEN3S-2003-08-08-eng-informix-ontape
daemon@ATHENA.MIT.EDU (pask@open3s.com)
Thu Jan 29 13:59:37 2004
Date: Thu, 29 Jan 2004 10:19:58 +0100 (CET)
From: pask@open3s.com
To: bugtraq@securityfocus.com
Message-ID: <Pine.LNX.4.44.0401291019050.8927-100000@hades2.concha.upv.es>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
----------========== OPEN3S-2003-08-08-eng-informix-ontape ==========----------
Title: Local Vulnerability at Informix IDSv9.40 via ontape binary
Date: 08-08-2003
Platform: Only tested in Linux but can be exported to others.
Impact: Any user with DSA privileges over Informix could achieve root
privileges through a stack buffer overflow in ontape binary
Author: Juan Manuel Pascual Escriba pask@open3s.com
Status: Solved by IBM Corp.
PROBLEM SUMMARY:
Stack Buffer overflow exists in ONCONFIG environment variable read
process when it's bigger than 495 bytes.
[informix@dimoni bin]$ export ONCONFIG=`perl -e 'print "A"x495'`
[informix@dimoni bin]$ ./ontape
WARNING: Cannot access configuration file $INFORMIXDIR/etc/$ONCONFIG.
Segmentation fault
[pask@dimoniet bin]$ gdb ./ontape
(gdb) r
WARNING: Cannot access configuration file $INFORMIXDIR/etc/$ONCONFIG.
Segmentation fault
(gdb) info reg
eax 0xffffffff -1
ecx 0x40083580 1074279808
edx 0x46 70
ebx 0x1 1
esp 0xbfff74a0 0xbfff74a0
ebp 0x41414141 0x41414141
esi 0xbfff74cc -1073777460
edi 0x0 0
eip 0x41414141 0x41414141
It's posible to achieve root privileges through this buffer overflow.
IMPACT:
Any user with exec permision over ontape could achieve root
privileges. In my default installation only users with DSA privileges
can exec this binary.
SOLUTION:
See more infomartion about this vulnerability and workaround at:
http://www-1.ibm.com/support/docview.wss?uid=swg21153336
STATUS
Reported to IBM security team at 11th of August 2003
See more infomartion about this vulnerability and workaround at:
http://www-1.ibm.com/support/docview.wss?uid=swg21153336
This vulnerability was managed in an efficient manner by Jonathan Leffler
from IBM Informix Database Engineering Team.
EXPLOIT
http://www.open3s.com/exploits/OPEN3S-2003-08-08-eng-informix-ontape.c
--------------------------------------------------
This vulnerability was researched by:
Juan Manuel Pascual Escriba pask@open3s.com
Barcelona - Spain http://www.open3s.com
