Date: Thu, 12 Sep 1996 12:50:29 +0400 (MSD) From: Igor Vinokurov <igor@cs.ibank.ru> To: wdl@tversu.ac.ru Subject: BoS: Sendmail 8.7.5 vulnerability (fwd) Message-ID: <199609120850.MAA12061@escape.cs.ibank.ru>
next in thread | raw e-mail | index | archive | help
--ELM842518229-12047-0_
Content-Type: message/rfc822
Content-Disposition: inline
Content-Description: Forwarded message from What we're dealing with here is a blatant disrespect of the law!
Content-Transfer-Encoding: 7bit
Return-Path: best-of-security-request@suburbia.net
Received: from pdx1.world.net (pdx1.world.net [192.243.32.18]) by escape.cs.ibank.ru (8.7.5/8.7.3/Zynaps) with ESMTP id MAA11957 for <igor@cs.ibank.ru>; Thu, 12 Sep 1996 12:33:01 +0400 (MSD)
Received: from suburbia.net (suburbia.net [203.4.184.1]) by pdx1.world.net (8.7.5/8.7.3) with ESMTP id BAA22304; Thu, 12 Sep 1996 01:15:41 -0700 (PDT)
Received: (list@localhost) by suburbia.net (8.7.4/Proff-950810) id QAA17608; Thu, 12 Sep 1996 16:35:22 +1000
Resent-Date: Thu, 12 Sep 1996 16:35:22 +1000
Approved-By: ALEPH1@UNDERGROUND.ORG
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Approved-By: What we're dealing with here is a blatant disrespect of the law!
<mudge@L0PHT.COM>
Message-ID: <Pine.BSI.3.95.960911125156.18262A-100000@l0pht.com>
Date: Wed, 11 Sep 1996 12:54:23 -0400
Reply-To: "What we're dealing with here is a blatant disrespect of the law!" <mudge@l0pht.com>
Sender: proff@suburbia.net
From: "What we're dealing with here is a blatant disrespect of the law!" <mudge@l0pht.com>
X-To: best-of-security@suburbia.net
To: Multiple recipients of list BUGTRAQ <BUGTRAQ@netspace.org>
Resent-Message-ID: <"dLRo22.0.wI4.XywDo"@suburbia>
Resent-From: best-of-security@suburbia.net
X-Mailing-List: <best-of-security@suburbia.net> archive/latest/351
X-Loop: best-of-security@suburbia.net
Precedence: list
Resent-Sender: best-of-security-request@suburbia.net
Subject: BoS: Sendmail 8.7.5 vulnerability
L0pht Security Advisory
Application: Sendmail 8.7.5
Platforms: All
Severity: any local user can gain
root priveledges.
Author: mudge@l0pht.com
Scenario:
Due to a problem with the code in sendmail a buffer overflow condition
exists that allows a user to overwrite the information in a saved
stack frame. When the function returns, the saved frame is popped off of
the stack and user code can be executed.
An exploit script will be made public upon the actual release of
Sendmail 8.8 which fixes this particular exploitable code segment.
Example:
> id
uid=621(mudge) gid=200(users)
> ./sploit.sh 3883
chfn: rebuilding the database...
chfn: done
using arg of [0x-------- (hex) + 3883(dec)]
# id
uid=621(mudge) euid=0(root) gid=200(users)
# ./up
# id
uid=0(root) gid=200(users)
If a user is able to alter his/her gecos field then that user can
exploit a coding flaw in sendmail to elevate their effective UID to 0.
Various operating systems ship with chfn(1) which enables users to
change their gecos field. Some of the operating systems that ship with
this program are NetBSD, FreeBSD, BSDI, OpenBSD, and Linux. It has
not been extensively researched as to what others come out of the
box with this functionality. Even if your operating system does not
ship with this functionality, it has been witnessed that many service
providers offering shell accounts add these, or equivalent utils,
in order to minimize their administrative tasks and to facilitate
user functionality. No matter, the flaw is a coding problem in sendmail and
not the fact that these other programs exist.
The actual problem in the code is quite apparent.
Inside recipient.c we find the following:
char nbuf[MAXNAME + 1];
...
buildfname(pw->pw_gecos, pw->pw_name, nbuf);
The problem is that nbuf[MAXNAME + 1] is a fixed length buffer and as
we will soon see, buildfname() does not honor this.
from util.c:
void
buildfname(gecos, login, buf)
register char *gecos;
char *login;
char *buf;
{
register char *p;
register char *bp = buf;
int l;
...
/* now fill in buf */
for (p = gecos; *p != '\0' && *p != ',' && *p != ';' && *p != '%'; p++)
{
if (*p == '&')
{
(void) strcpy(bp, login);
*bp = toupper(*bp);
while (*bp != '\0')
bp++;
}
else
*bp++ = *p;
}
*bp = '\0';
}
Here we see that buildfname() happily copies whatever size we can hand
it into nbuf[MAXNAME +1]. The function is even nice enough to append
a null to the string in case we wanted to put our machine opcodes and
operands inside the gecos field. Though this is one way of doing it,
we opted for another method that enabled us more freedom with the
various methods of altering ones gecos field.
Solution:
This particular problem has been fixed in Sendmail 8.8 beta.
A temporary fix is to remove the ability for users on a local system
to change their gecos (commonly referred to as 'real-name') field.
mudge@l0pht.com
--ELM842518229-12047-0_--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199609120850.MAA12061>