bugtraq - RE: Solaris ld.so.1 buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 30 Jul 2003 12:37:44 -0400
From: "Rukshin, David" <rukshin@...haw.com>
To: <cwalker@....com>, "Jouko Pynnonen" <jouko@....fi>,
	<bugtraq@...urityfocus.com>
Subject: RE: Solaris ld.so.1 buffer overflow


Modify the command (you need to add a trailing slash) to be the following:

LD_PRELOAD=/`perl -e 'print "A"x2000'`/ passwd

and try it again.

Thanks,
Dave 

-----Original Message-----
From: clint walker [mailto:cwalker@....com] 
Sent: Wednesday, July 30, 2003 10:28 AM
To: 'Jouko Pynnonen'; bugtraq@...urityfocus.com
Subject: RE: Solaris ld.so.1 buffer overflow


Juoko,

I ran the command ($ LD_PRELOAD=/`perl -e 'print "A"x2000'` passwd) on a
patched box as well as an unpatched box.

In both cases I got the same output (see below).

My question is: if there's no segmentation fault, does that mean the system
is not vulnerable?

$ LD_PRELOAD=/`perl -e 'print
"A"x2000'` passwd
ld.so.1: passwd: warning:
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAA: open failed: illegal insecure pathname
passwd: Changing password for <username>
Enter existing login password:

-----Original Message-----
From: Jouko Pynnonen [mailto:jouko@....fi]
Sent: Tuesday, July 29, 2003 4:36 PM
To: bugtraq@...urityfocus.com
Subject: Solaris ld.so.1 buffer overflow





OVERVIEW
========

There is a buffer overflow vulnerability in the Solaris runtime linker,
/lib/ld.so.1. A local user can gain elevated privileges if there are
any dynamically linked, executable SUID/SGID programs in the
filesystem.

On a typical Solaris installation most or all SUID/SGID programs are
dynamically linked. The trend has been to completely move towards
dynamically linked binaries due to Sun's recommendation. Support for
static binaries will be removed in Solaris 10.



DETAILS
=======

The environment variable LD_PRELOAD is used to force ld.so.1 to load
the specified library during runtime linking. If a setuid or setgid
program is being loaded, the value of this variable is checked to
prevent a potential malicious user-defined library to be linked in. In
this case the linker only accepts libraries located under certain
trusted directories. The code doing this evaluation is most likely the
point containing the "unchecked buffer".

The buffer overflow happens if the LD_PRELOAD value starts and ends
with a slash and contains about 1200 characters. An exploit won't be
presented here, but the existance of the vulnerability can be tested
like this:

  $ LD_PRELOAD=/`perl -e 'print "A"x2000'` passwd
  ld.so.1: passwd: warning /AAAAAAA ... AAAAA/: open failed: illegal
  insecure pathname
  Segmentation Fault (core dumped)

My test exploit for Solaris 9 / SPARC gets a root shell by setting
the variable and starting /usr/bin/passwd. The exploit builds a fake
stack frame and causes the linker to return to libc in order to defeat
the nonexecutable stack protection. I haven't produced an exploit for
Intel platform, but according to Sun the vulnerability exists on both
platforms.



SOLUTION
========

Sun Microsystems was contacted on June 1st, 2003 and has released a fix
for the flaw. A complete list of vulnerable Solaris versions and the
fix can be found here:

  http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55680



CREDITS
=======

The vulnerability was discovered by Jouko Pynnönen, Finland.



--
Jouko Pynnonen          http://iki.fi/jouko/
jouko@....fi