Bekijk Volledige Versie : Re: Solaris ld.so.1 buffer overflow
Jouko Pynnonen
31/07/03, 14:01
On Wed, Jul 30, 2003 at 12:37:44PM -0400, Rukshin, David wrote:
> Modify the command (you need to add a trailing slash) to be the following:
>
> LD_PRELOAD=/`perl -e 'print "A"x2000'`/ passwd
>
> and try it again.
That's right, my original message had a typo, the trailing slash was
missing. Thanks for noticing this, David. Without the slash nothing
special happens. My apologies,
--
Jouko Pynnonen http://iki.fi/jouko/
jouko@iki.fi
Jouko Pynnonen
31/07/03, 14:01
On Wed, Jul 30, 2003 at 12:37:44PM -0400, Rukshin, David wrote:
> Modify the command (you need to add a trailing slash) to be the following:
>
> LD_PRELOAD=/`perl -e 'print "A"x2000'`/ passwd
>
> and try it again.
That's right, my original message had a typo, the trailing slash was
missing. Thanks for noticing this, David. Without the slash nothing
special happens. My apologies,
--
Jouko Pynnonen http://iki.fi/jouko/
jouko@iki.fi
Rukshin, David
31/07/03, 14:01
Modify the command (you need to add a trailing slash) to be the =
following:
LD_PRELOAD=3D/`perl -e 'print "A"x2000'`/ passwd
and try it again.
Thanks,
Dave=20
-----Original Message-----
From: clint walker [mailto:cwalker@gnx.com]=20
Sent: Wednesday, July 30, 2003 10:28 AM
To: 'Jouko Pynnonen'; bugtraq@securityfocus.com
Subject: RE: Solaris ld.so.1 buffer overflow
Juoko,
I ran the command ($ LD_PRELOAD=3D/`perl -e 'print "A"x2000'` passwd) on =
a
patched box as well as an unpatched box.
In both cases I got the same output (see below).
My question is: if there's no segmentation fault, does that mean the =
system
is not vulnerable?
$ LD_PRELOAD=3D/`perl -e 'print
"A"x2000'` passwd
ld.so.1: passwd: warning:
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAA: open failed: illegal insecure pathname
passwd: Changing password for <username>
Enter existing login password:
-----Original Message-----
From: Jouko Pynnonen [mailto:jouko@iki.fi]
Sent: Tuesday, July 29, 2003 4:36 PM
To: bugtraq@securityfocus.com
Subject: Solaris ld.so.1 buffer overflow
OVERVIEW
=3D=3D=3D=3D=3D=3D=3D=3D
There is a buffer overflow vulnerability in the Solaris runtime linker,
/lib/ld.so.1. A local user can gain elevated privileges if there are
any dynamically linked, executable SUID/SGID programs in the
filesystem.
On a typical Solaris installation most or all SUID/SGID programs are
dynamically linked. The trend has been to completely move towards
dynamically linked binaries due to Sun's recommendation. Support for
static binaries will be removed in Solaris 10.
DETAILS
=3D=3D=3D=3D=3D=3D=3D
The environment variable LD_PRELOAD is used to force ld.so.1 to load
the specified library during runtime linking. If a setuid or setgid
program is being loaded, the value of this variable is checked to
prevent a potential malicious user-defined library to be linked in. In
this case the linker only accepts libraries located under certain
trusted directories. The code doing this evaluation is most likely the
point containing the "unchecked buffer".
The buffer overflow happens if the LD_PRELOAD value starts and ends
with a slash and contains about 1200 characters. An exploit won't be
presented here, but the existance of the vulnerability can be tested
like this:
$ LD_PRELOAD=3D/`perl -e 'print "A"x2000'` passwd
ld.so.1: passwd: warning /AAAAAAA ... AAAAA/: open failed: illegal
insecure pathname
Segmentation Fault (core dumped)
My test exploit for Solaris 9 / SPARC gets a root shell by setting
the variable and starting /usr/bin/passwd. The exploit builds a fake
stack frame and causes the linker to return to libc in order to defeat
the nonexecutable stack protection. I haven't produced an exploit for
Intel platform, but according to Sun the vulnerability exists on both
platforms.
SOLUTION
=3D=3D=3D=3D=3D=3D=3D=3D
Sun Microsystems was contacted on June 1st, 2003 and has released a fix
for the flaw. A complete list of vulnerable Solaris versions and the
fix can be found here:
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=3Dfsalert/55680
CREDITS
=3D=3D=3D=3D=3D=3D=3D
The vulnerability was discovered by Jouko Pynn=F6nen, Finland.
--
Jouko Pynnonen http://iki.fi/jouko/
jouko@iki.fi
clint walker
31/07/03, 14:01
Juoko,
I ran the command ($ LD_PRELOAD=3D/`perl -e 'print "A"x2000'` passwd)=
on a
patched box as well as an unpatched box.
In both cases I got the same output (see below).
My question is: if there's no segmentation fault, does that mean the =
system
is not vulnerable?
$ LD_PRELOAD=3D/`perl -e 'print
"A"x2000'` passwd
ld.so.1: passwd: warning:
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAA: open failed: illegal insecure pathname
passwd: Changing password for <username>
Enter existing login password:
-----Original Message-----
=46rom: Jouko Pynnonen [mailto:jouko@iki.fi]
Sent: Tuesday, July 29, 2003 4:36 PM
To: bugtraq@securityfocus.com
Subject: Solaris ld.so.1 buffer overflow
OVERVIEW
=3D=3D=3D=3D=3D=3D=3D=3D
There is a buffer overflow vulnerability in the Solaris runtime linke=
r,
/lib/ld.so.1. A local user can gain elevated privileges if there are
any dynamically linked, executable SUID/SGID programs in the
filesystem.
On a typical Solaris installation most or all SUID/SGID programs are
dynamically linked. The trend has been to completely move towards
dynamically linked binaries due to Sun's recommendation. Support for
static binaries will be removed in Solaris 10.
DETAILS
=3D=3D=3D=3D=3D=3D=3D
The environment variable LD_PRELOAD is used to force ld.so.1 to load
the specified library during runtime linking. If a setuid or setgid
program is being loaded, the value of this variable is checked to
prevent a potential malicious user-defined library to be linked in. I=
n
this case the linker only accepts libraries located under certain
trusted directories. The code doing this evaluation is most likely th=
e
point containing the "unchecked buffer".
The buffer overflow happens if the LD_PRELOAD value starts and ends
with a slash and contains about 1200 characters. An exploit won't be
presented here, but the existance of the vulnerability can be tested
like this:
$ LD_PRELOAD=3D/`perl -e 'print "A"x2000'` passwd
ld.so.1: passwd: warning /AAAAAAA ... AAAAA/: open failed: illegal
insecure pathname
Segmentation Fault (core dumped)
My test exploit for Solaris 9 / SPARC gets a root shell by setting
the variable and starting /usr/bin/passwd. The exploit builds a fake
stack frame and causes the linker to return to libc in order to defea=
t
the nonexecutable stack protection. I haven't produced an exploit for
Intel platform, but according to Sun the vulnerability exists on both
platforms.
SOLUTION
=3D=3D=3D=3D=3D=3D=3D=3D
Sun Microsystems was contacted on June 1st, 2003 and has released a f=
ix
for the flaw. A complete list of vulnerable Solaris versions and the
fix can be found here:
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=3Dfsalert/55680
CREDITS
=3D=3D=3D=3D=3D=3D=3D
The vulnerability was discovered by Jouko Pynn=F6nen, Finland.
--
Jouko Pynnonen http://iki.fi/jouko/
jouko@iki.fi
Rukshin, David
31/07/03, 14:01
Modify the command (you need to add a trailing slash) to be the =
following:
LD_PRELOAD=3D/`perl -e 'print "A"x2000'`/ passwd
and try it again.
Thanks,
Dave=20
-----Original Message-----
From: clint walker [mailto:cwalker@gnx.com]=20
Sent: Wednesday, July 30, 2003 10:28 AM
To: 'Jouko Pynnonen'; bugtraq@securityfocus.com
Subject: RE: Solaris ld.so.1 buffer overflow
Juoko,
I ran the command ($ LD_PRELOAD=3D/`perl -e 'print "A"x2000'` passwd) on =
a
patched box as well as an unpatched box.
In both cases I got the same output (see below).
My question is: if there's no segmentation fault, does that mean the =
system
is not vulnerable?
$ LD_PRELOAD=3D/`perl -e 'print
"A"x2000'` passwd
ld.so.1: passwd: warning:
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAA=
AAA
AAAAAAAAAAAAAAAAAAAAAAAAA: open failed: illegal insecure pathname
passwd: Changing password for <username>
Enter existing login password:
-----Original Message-----
From: Jouko Pynnonen [mailto:jouko@iki.fi]
Sent: Tuesday, July 29, 2003 4:36 PM
To: bugtraq@securityfocus.com
Subject: Solaris ld.so.1 buffer overflow
OVERVIEW
=3D=3D=3D=3D=3D=3D=3D=3D
There is a buffer overflow vulnerability in the Solaris runtime linker,
/lib/ld.so.1. A local user can gain elevated privileges if there are
any dynamically linked, executable SUID/SGID programs in the
filesystem.
On a typical Solaris installation most or all SUID/SGID programs are
dynamically linked. The trend has been to completely move towards
dynamically linked binaries due to Sun's recommendation. Support for
static binaries will be removed in Solaris 10.
DETAILS
=3D=3D=3D=3D=3D=3D=3D
The environment variable LD_PRELOAD is used to force ld.so.1 to load
the specified library during runtime linking. If a setuid or setgid
program is being loaded, the value of this variable is checked to
prevent a potential malicious user-defined library to be linked in. In
this case the linker only accepts libraries located under certain
trusted directories. The code doing this evaluation is most likely the
point containing the "unchecked buffer".
The buffer overflow happens if the LD_PRELOAD value starts and ends
with a slash and contains about 1200 characters. An exploit won't be
presented here, but the existance of the vulnerability can be tested
like this:
$ LD_PRELOAD=3D/`perl -e 'print "A"x2000'` passwd
ld.so.1: passwd: warning /AAAAAAA ... AAAAA/: open failed: illegal
insecure pathname
Segmentation Fault (core dumped)
My test exploit for Solaris 9 / SPARC gets a root shell by setting
the variable and starting /usr/bin/passwd. The exploit builds a fake
stack frame and causes the linker to return to libc in order to defeat
the nonexecutable stack protection. I haven't produced an exploit for
Intel platform, but according to Sun the vulnerability exists on both
platforms.
SOLUTION
=3D=3D=3D=3D=3D=3D=3D=3D
Sun Microsystems was contacted on June 1st, 2003 and has released a fix
for the flaw. A complete list of vulnerable Solaris versions and the
fix can be found here:
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=3Dfsalert/55680
CREDITS
=3D=3D=3D=3D=3D=3D=3D
The vulnerability was discovered by Jouko Pynn=F6nen, Finland.
--
Jouko Pynnonen http://iki.fi/jouko/
jouko@iki.fi
clint walker
31/07/03, 14:01
Juoko,
I ran the command ($ LD_PRELOAD=3D/`perl -e 'print "A"x2000'` passwd)=
on a
patched box as well as an unpatched box.
In both cases I got the same output (see below).
My question is: if there's no segmentation fault, does that mean the =
system
is not vulnerable?
$ LD_PRELOAD=3D/`perl -e 'print
"A"x2000'` passwd
ld.so.1: passwd: warning:
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA=
AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAA: open failed: illegal insecure pathname
passwd: Changing password for <username>
Enter existing login password:
-----Original Message-----
=46rom: Jouko Pynnonen [mailto:jouko@iki.fi]
Sent: Tuesday, July 29, 2003 4:36 PM
To: bugtraq@securityfocus.com
Subject: Solaris ld.so.1 buffer overflow
OVERVIEW
=3D=3D=3D=3D=3D=3D=3D=3D
There is a buffer overflow vulnerability in the Solaris runtime linke=
r,
/lib/ld.so.1. A local user can gain elevated privileges if there are
any dynamically linked, executable SUID/SGID programs in the
filesystem.
On a typical Solaris installation most or all SUID/SGID programs are
dynamically linked. The trend has been to completely move towards
dynamically linked binaries due to Sun's recommendation. Support for
static binaries will be removed in Solaris 10.
DETAILS
=3D=3D=3D=3D=3D=3D=3D
The environment variable LD_PRELOAD is used to force ld.so.1 to load
the specified library during runtime linking. If a setuid or setgid
program is being loaded, the value of this variable is checked to
prevent a potential malicious user-defined library to be linked in. I=
n
this case the linker only accepts libraries located under certain
trusted directories. The code doing this evaluation is most likely th=
e
point containing the "unchecked buffer".
The buffer overflow happens if the LD_PRELOAD value starts and ends
with a slash and contains about 1200 characters. An exploit won't be
presented here, but the existance of the vulnerability can be tested
like this:
$ LD_PRELOAD=3D/`perl -e 'print "A"x2000'` passwd
ld.so.1: passwd: warning /AAAAAAA ... AAAAA/: open failed: illegal
insecure pathname
Segmentation Fault (core dumped)
My test exploit for Solaris 9 / SPARC gets a root shell by setting
the variable and starting /usr/bin/passwd. The exploit builds a fake
stack frame and causes the linker to return to libc in order to defea=
t
the nonexecutable stack protection. I haven't produced an exploit for
Intel platform, but according to Sun the vulnerability exists on both
platforms.
SOLUTION
=3D=3D=3D=3D=3D=3D=3D=3D
Sun Microsystems was contacted on June 1st, 2003 and has released a f=
ix
for the flaw. A complete list of vulnerable Solaris versions and the
fix can be found here:
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=3Dfsalert/55680
CREDITS
=3D=3D=3D=3D=3D=3D=3D
The vulnerability was discovered by Jouko Pynn=F6nen, Finland.
--
Jouko Pynnonen http://iki.fi/jouko/
jouko@iki.fi
This is on a default solaris 9 install, no patches installed.
bash-2.05$ LD_PRELOAD=/`perl -e 'print "A"x2000'`/ passwd
ld.so.1: passwd: warning:
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAA/:
open failed: illegal insecure pathname
Segmentation Fault
bash-2.05$
~!>D
Jouko Pynnonen wrote:
>
> On Wed, Jul 30, 2003 at 12:37:44PM -0400, Rukshin, David wrote:
>
>>Modify the command (you need to add a trailing slash) to be the following:
>>
>>LD_PRELOAD=/`perl -e 'print "A"x2000'`/ passwd
>>
>>and try it again.
>
>
>
> That's right, my original message had a typo, the trailing slash was
> missing. Thanks for noticing this, David. Without the slash nothing
> special happens. My apologies,
>
>
>
--
- DrippingDead Films -
downs@drippingdead.com
http://www.drippingdead.com
Key fingerprint = 56ED 70FC AF9D 3D98 C908 90F9 D93E 0CA7 290E EE37
Crist J. Clark
04/08/03, 22:00
On Tue, Jul 29, 2003 at 11:36:18PM +0300, Jouko Pynnonen wrote:
>
> OVERVIEW
> ========
>
> There is a buffer overflow vulnerability in the Solaris runtime linker,
> /lib/ld.so.1. A local user can gain elevated privileges if there are
> any dynamically linked, executable SUID/SGID programs in the
> filesystem.
[snip]
According to the Sun Alert on this vulnerability,
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55680
Various patchlevels of Solaris 2.6, 7, 8, and 9 sparc and i386 are all
vulnerable.
On Solaris 2.5.1,
$ uname -a
SunOS wallace 5.5.1 Generic_103640-40 sun4u sparc SUNW,Ultra-Enterprise
When I try the simple,
$ LD_PRELOAD=/`perl -e 'print "A"x2000'`/ passwd
passwd: Changing password for cclark
Enter login(NIS) password:
It doesn't crash. That reassures me somewhat, but does anyone know if
2.5.1 is not listed because it is (a) no longer supported and not
tested and patched, or (b) not actually vulnerable?
Thanks.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org