Re: openbsd 3.4 ps bug

["Kurt Seifried" <bt () seifried org>]

> Security bug for openbsd 3.4
>
> While i was testing my new openbsd 3.4 i found the following problem.
> First of all i have the OpenBSD3.4 FUlly patched with all the latest
> fixes in an i386 machine (P3 128mb ram).Some of the ports were installed
> too(From the oficial 3cd set which i bought).While i was playing with the
> command ps i found the following which i have tested it in two machines
with
> four different kernels(2 patched and 2 unpatched).The utility ps has a
flaw
> when used with the bash shell.Go to your root(/) directory or any dir that
> contains more then two files or directorys and give the command ps -p * or
> ps -N * or ps -M * and you will instantly see a core dump file in your
dir.
> The ps program is giving us a signal (SIGSEGV).Please try all the above
args
> more then two times and first in your root dir.When i tried to confirm it
with
> the gdb it gave me the address 0x1c01c116 in ?? ().I don`t have the
> time to confirm if the bug is exploitable or not but it is a big problem
> because a user(id 1000+) can also do that.This is a report which will also
> be submited in the bugtraq.It is also not confirmed that other versions
are
> vulnerable to this bug.This bug can only be reproduced when bash2 is
installed
> (from the official ports package) and a in a dir where more then two files
exists.
> Sorry for the bad englis.
>
> The openbsd team has been informed.

Yes this creates a core dump. I fail to see how this is exploitable for
additional privileges however as ps is not setuid/setgid (simply mode 0555).
Can you please enlighten us as to how this is exploitable for additional
privileges?


Kurt Seifried, kurt () seifried org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/