Calife heap corrupt / potential local root exploit

[DownBload]

Calife heap corrupt / potential local root exploit
--------------------------------------------------
by Leon Juranic a.k.a DownBload <downbload@hotmail.com> / II-Labs


Version affected(tested): calife-2.8.4c and calife-2.8.5
- calife can be found at packages.debian.org, FreeBSD 5.0 (security), ...

From `man calife`:
....
Description:
Calife requests user's own password for becoming login (or root, if no login is provided), and switches to that user and group ID after verify-ing proper rights to do so. A shell is then executed. If calife is exe-cuted by root, no password is requ
ested and a shell with the appropriate user ID is executed.
....

[downbload@localhost downbload]$ ls -al `whereis calife`
ls: calife:: No such file or directory
-r-------- 1 root wheel 159 Feb 19 15:54 /etc/calife.auth
-rwsr-xr-x 1 root wheel 575623 Feb 5 14:49 /usr/local/bin/calife

[downbload@localhost downbload]$ calife luser
Password: "A" x 3000
Password: real_user_password
Segmentation fault
[downbload@localhost downbload]$

- "A" x 3000 will corrupt the heap.
- If real_user_password isn't correct, calife will do exit()
- If attacker wants to exploit calife, there must be at least one user "available" in /etc/calife.auth


/root/calife-2.8.4c/db.c
------------------------
...
char got_pass = 0;
char * pt_pass, * pt_enc,
* user_pass, * enc_pass, salt [10];

user_pass = (char *) xalloc (l_size);
enc_pass = (char *) xalloc (l_size);
...
for ( i = 0; i < 3; i ++ )
{
pt_pass = (char *) getpass ("Password:");
memset (user_pass, '\0', l_size);
strcpy (user_pass, pt_pass); // <- BAD CODE
pt_enc = (char *) crypt (user_pass, calife->pw_passwd);
memset (enc_pass, '\0', l_size);
strcpy (enc_pass, pt_enc);
}
...
free (user_pass); // <- FUN CODE ;-)
free (enc_pass); // <- FUN CODE ;-)
...

------------------------

We can pass very long password string to calife and corrupt it's heap (overwrite boundary tags).
However, it isn't easy to exploit this bug, because every newline, backspace, etc. character from user input will affect exploitation (e.g. backspace char will delete one char from user input - exploitation string).

Greetz to h4z4rd, BoyScout, finis, Fr1c, lucious, manikal, Gorans, slash, j0e, smak, Bojan, wootz...

Bye.

[Ollivier Robert]

In-Reply-To: <20040227091921.26210.qmail@www.securityfocus.com>

>Calife heap corrupt / potential local root exploit
>--------------------------------------------------
>by Leon Juranic a.k.a DownBload <downbload@hotmail.com> / II-Labs
>
>
>Version affected(tested): calife-2.8.4c and calife-2.8.5
>- calife can be found at packages.debian.org, FreeBSD 5.0 (security), ...

Thanks you for taking the time to contact me before sending such a mail to Bugtraq. It is always nice to deal with such nice people [NOT!]

>[downbload@localhost downbload]$ calife luser
>Password: "A" x 3000
>Password: real_user_password
>Segmentation fault
>[downbload@localhost downbload]$

Interesting, on which plateform? I just tried that on FreeBSD 4.9, 5.2 and could not reproduce.

On Linux/Debian, it does segfault. glibc problem?

>- "A" x 3000 will corrupt the heap.
>- If real_user_password isn't correct, calife will do exit()
>- If attacker wants to exploit calife, there must be at least one user "available" in /etc/calife.auth

Do you have such an exploit? I'd like to see it.

> pt_pass = (char *) getpass ("Password:");
> memset (user_pass, '\0', l_size);
> strcpy (user_pass, pt_pass); // <- BAD CODE

I could have used strlcpy but I assumed (and my reading of the FreeBSD source code confirm it) that getpass(3) was doing the size check.

In FreeBSD, it seems not possible to overflow that as the code verify the length.

I'll release 2.8.6 today.

Courtesy seems to go down the gutters these days apparently.

Ollivier, pissed off.

[Carson Gaspar]

--On Friday, February 27, 2004 16:49:34 +0000 Ollivier Robert
<roberto@keltia.freenix.fr> wrote:

> In-Reply-To: <20040227091921.26210.qmail@www.securityfocus.com>
>
>> pt_pass = (char *) getpass ("Password:");
>> memset (user_pass, '\0', l_size);
>> strcpy (user_pass, pt_pass); // <- BAD CODE
>
> I could have used strlcpy but I assumed (and my reading of the FreeBSD
> source code confirm it) that getpass(3) was doing the size check.

This is why you shouldn't make such assumptions. Never assume someone else
validated your input. If you want to write secure code, assume every
function is under attack from every other function, because someday someone
will change the program flow, bypassing your carefully crafted validation
function and passing garbage to your insecure code. Outsourcing your
validation to other code is the software equivalent of the hard outside /
soft tasty center security model.

--
Carson

[Ollivier Robert]

According to Carson Gaspar:
> This is why you shouldn't make such assumptions. Never assume someone else
> validated your input. If you want to write secure code, assume every

That's why I just released 2.8.6 which correct this.

I'm thankful of the problem but I'd rather been informed before it goes in the
wild.
--
Ollivier ROBERT -=- FreeBSD: The Power to Serve! -=- roberto@keltia.freenix.fr
Darwin snuadh.freenix.org Kernel Version 7.2.0: Thu Dec 11 16:20:23 PST 2003