Re: Buffer overflow/privilege escalation in MacOS X

[David Riley <oscar () the-rileys net>]

On Dec 15, 2003, at 2:54 PM, Max wrote:

> Hi,
>
> It appears that parts of MacOSX that didn't come from BSD are
> not very well written and have significant security issues.
>
> An example is a /System/Library/Filesystems/cd9660.fs/cd9660.util
> utility. It is suid root and it is vulnerable to a classic buffer
> overflow due to the lack of input validation.
[snip]

> sdsx:/System/Library/Filesystems/cd9660.fs root# gdb -core 
> /cores/core.1405 ./cd9660.util
> [gdb banner here]
> Reading symbols for shared libraries .... done
> Core was generated by `./cd9660.util'.
> #0  0x9000d360 in strcat ()
> (gdb) where
> #0  0x9000d360 in strcat ()
> #1  0x00002b84 in main ()
> #2  0x41414141 in ?? ()

Unfortunately, I don't think this is exploitable.  main() would have to 
blr instead of making a system call to exit() for this to be 
exploitable.  Additionally, no other calls seem to call any exploitable 
functions like strcat or strcpy.  This would probably be exploitable if 
the function calling it wasn't main().

For what it's worth, the segfault comes from a bad access when strcat 
tries to read from 0x41414141 because its source vector gets 
overwritten by an earlier strcat (the destination vectors are stored 
earlier in memory and can't be overwritten, not that you'd be likely to 
be able to do anything with the overwritten vectors since there don't 
seem to be any places you can overwrite the stored link register value 
- main sticks it in a register, doesn't touch it, and in fact doesn't 
even use the saved value for returning, since it calls exit()).