Date: Mon, 28 Aug 1995 23:29:54 -0400 (EDT) From: "Jonathan M. Bresler" <jmb@kryten.Atinc.COM> To: security@freebsd.org Subject: [8lgm]-Advisory-22.UNIX.syslog.2-Aug-1995 (fwd) Message-ID: <Pine.3.89.9508282325.D12292-0100000@kryten.atinc.com>
next in thread | raw e-mail | index | archive | help
from a quick persual of the syslog.c that we have in -stable, i'd say
that FreeBSD is vunerable to this attack. our syslog has fixed size
buffers and uses sprintf to write to them. should be changed to
snprintf--a quick persual says that should do the trick
shades of rtm
jmb
Jonathan M. Bresler jmb@kryten.atinc.com | Analysis & Technology, Inc.
FreeBSD Postmaster jmb@FreeBSD.Org | 2341 Jeff Davis Hwy
play go. | Arlington, VA 22202
ride bike. hack FreeBSD.--ah the good life | 703-418-2800 x346
---------- Forwarded message ----------
Date: Tue, 29 Aug 1995 02:33:37 +0100 (BST)
From: [8LGM] Security Team <8lgm@8lgm.org>
To: 8lgm-advisories@8lgm.org, bugtraq@crimelab.com,
firewalls@greatcircle.com
Subject: [8lgm]-Advisory-22.UNIX.syslog.2-Aug-1995
=============================================================================
Virtual Domain Hosting Services provided by The FOURnet Information Network
mail webserv@FOUR.net or see http://www.four.net
=============================================================================
[8lgm]-Advisory-22.UNIX.syslog.2-Aug-1995
VULNERABLE PROGRAMS:
All programs calling syslog(3) with user supplied data, without
checking argument lengths.
KNOWN VULNERABLE PLATFORMS:
SunOS 4.1.*
KNOWN SECURE PLATFORMS:
None at present.
DESCRIPTION:
syslog(3) uses an internal buffer to build messages. However
it performs no bound checking, and relies on the caller to
check arguments passed to it.
IMPACT:
Local and remote users can obtain root access.
REPEAT BY:
We have written an example exploit to overwrite syslog(3)'s
internal buffer using SunOS sendmail(8). However due to the
severity of this problem, this code will not be made available
to anyone at this time. Please note that the exploit was fairly
straightforward to put together, therefore expect exploits to be
widely available soon after the release of this advisory.
Here is a edited sample of using a modified telnet client to
obtain a root shell through SunOS sendmail(8) on a sparc
based machine.
legless[8lgm]% syslog_telnet localhost smtp
Trying 127.0.0.1 ...
Connected to localhost.
Escape character is '^]'.
220 legless.8lgm.org Sendmail 4.1/SMI-4.1 ready at Sun,\
27 Aug 95 15:56:27 BST
mail from: root
250 root... Sender ok
rcpt to: root
250 root... Recipient ok
data
354 Enter mail, end with "." on a line by itself
^]
syslog_telnet>
### At this point, we provide some information to the modified
### telnet client about the remote host. Then sparc instructions
### are sent over the link within the body of the message to
### execute a shell.
###
### As soon as data is finished (with .), sendmail will eventually
### report, through syslog(3), data about this message. syslog's
### internal buffer will be overwritten, and our supplied
### instructions are executed.
Hit <cr>, then .<cr>
.
/usr/bin/id;
uid=0(root) gid=0(wheel) groups=0(wheel)
/bin/sh: ^M: not found
uptime;
3:57pm up 1:25, 5 users, load average: 0.11, 0.05, 0.00
/bin/sh: ^M: not found
exit;
Connection closed by foreign host.
### Here we can see that sendmail has execed a shell as root,
### and that we can type commands. (lines ending in ; are
### user input through the telnet client).
###
### This exploit could be further expanded upon to encapsulate
### instructions within the body of a message, which can then
### be mailed out to a site (ie without the necessity to connect
### directly to the smtp port). This may be used to bypass
### firewalls.
WORKAROUNDS:
We have two methods to ensure that syslog(3) can not be used in
the above manner.
Fix syslog(3), to perform bound checking. Shared libraries
can be then fixed to use the new function. Statically linked
programs will require rebuilding.
Alternatively, ensure all calls to syslog(3), by all programs,
check all arguments passed to syslog(3).
Ideally both of the above should be implemented.
FIX:
Contact vendors for fixes.
STATUS UPDATE:
The file:
[8lgm]-Advisory-22.UNIX.syslog.2-Aug-1995.README
will be created on www.8lgm.org. This will contain updates on
any further versions which are found to be vulnerable, and any
other information received pertaining to this advisory.
-----------------------------------------------------------------------
FEEDBACK AND CONTACT INFORMATION:
majordomo@8lgm.org (Mailing list requests - try 'help'
for details)
8lgm@8lgm.org (Everything else)
8LGM FILESERVER:
All [8LGM] advisories may be obtained via the [8LGM] fileserver.
For details, 'echo help | mail 8lgm-fileserver@8lgm.org'
8LGM WWW SERVER:
[8LGM]'s web server can be reached at http://www.8lgm.org.
This contains details of all 8LGM advisories and other useful
information.
===========================================================================
--
-----------------------------------------------------------------------
$ echo help | mail 8lgm-fileserver@8lgm.org (Fileserver help)
majordomo@8lgm.org (Request to be added to list)
8lgm@8lgm.org (General enquiries)
******* VISIT 8LGM ON THE WORLD WIDE WEB: http://www.8lgm.org ********
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.3.89.9508282325.D12292-0100000>