bugtraq - Re: [SECURITY] [DSA 139-1] New super packages fix local root exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 21 Jun 2004 06:02:21 -0700
From: <gobbles@...hmail.com>
To: full-disclosure@...ts.netsys.com
Cc: bugtraq@...urityfocus.com, vuln-dev@...urityfocus.com
Subject: Re: [SECURITY] [DSA 139-1] New super packages fix local root exploit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi list!@ hehehehe ;PPpPPPPPp

It appear Max Vozeler who wrap he packages for he debian friends did
travel back in time with he timemachine of many speed. Friend GOBBLES
not buy into whole space/time discussion ;PPpPPPP But anyways here
is friend GOBBLES of old! From he hushmail electronic mail of 2002.

Look here:
http://lists.netsys.com/pipermail/full-disclosure/2004-June/022831.html

GOBBLES did read:

   Package        : super
   Vulnerability  : format string
   Problem-Type   : remote
   Debian-specific: no
   CVE Ids        : CAN-2004-0579

   Max Vozeler discovered a format string vulnerability in super, a
   program to allow specified users to execute commands with root
   privileges.  This vulnerability could potentially be exploited by
a
   local user to execute arbitrary code with root privileges.

Probably smart to remember ripping published advisory that get small
bit
of mediocre media attention come back to bite you in the ass (related
to
butt, not mule hehehehe) but GOBBLES say that all in the behind!

Now GOBBLES pioneer many things and he appreciate new pioneering when
it not stale, so observe many fast patching here in Max patch:

   --- super-3.16.1.orig/error.c
   +++ super-3.16.1/error.c
   @@ -168,12 +168,12 @@
    void rsyslog P__(( unsigned int level, char *fmt, ... ));

    #define OpenLog(prog, opt, fac) ropenlog((prog), (opt), (fac), error_rlog_host)
   -#define SysLog(pri, buf) rsyslog((pri), (buf))
   +#define SysLog(pri, buf) rsyslog((pri), "%s", (buf))

    #else

    #define OpenLog(prog, opt, fac) openlog((prog), (opt), (fac))
   -#define SysLog(pri, buf) syslog((pri), (buf))
   +#define SysLog(pri, buf) syslog((pri), "%s", (buf))

    #endif

Ding ding ding! Deja vu. GOBBLES would like to point out he 2002
fame in 2002 (year of turkey):

http://lists.netsys.com/pipermail/full-disclosure/2002-July/000308.html

    * Problem:
    *
    * When super is compiled to use syslog(3) for its logging
    * of error messages the following lines makes pre-auth
    * local root exploitation rather trivial:
    *
    * From error.c
    * ...
    * #define SysLog(pri, buf) syslog((pri), (buf))
    * ...
    * SysLog(error_priority, buf);
    * ...
    *
    * This means users that are not in the super config file
    * will be able to execute code with root priviledges.
    *
    * "Super acts as a SetUID wrapper around system commands
    *  to make sure the commands are executed safely, and
    *  only by authorized users."
    *
    * 		hehehe ;PPpPPPPp
    *
    * Love,
    * GOBBLES

GOBBLES would like to take this opportunity to thank Max for celebrating
the two year aniversary of the SUPER bug. Thanks friend Max, you get
free t-shirt at defcon 2002 ;pPPpPPPpPP

For special bonus treat see debian patch history. GOBBLES wonder who
keep backdoor in anti-spam stale linux alive!? It a mystery!

References:
http://www.debian.org/security/2002/dsa-139
http://www.debian.org/security/2004/dsa-522

Debian project recommend replacing backdoored super program with new
version. GOBBLES would rather like to recommend concerned security
professional to replace Debian with better Linux, like 7350 Linux.
German friend at 7350 Linux Inc. is good at patching the many
GOBBLES bugs in he Linux.

Friend GOBBLES also need to take time to point out old Security
Focus page is outdated and urgently has to be updated to reflect
this mysterious bug!
Outdated web page is here: http://www.securityfocus.com/bid/5367

Love,
GOBBLES
GOBBLES@...hmail.com
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkDW3FsACgkQHNGnlyGZsA88vACfZ1zGct4qQ6EXJa8/EFtYDcNrif4A
oI3dqVSASPtpU6mazvKRS+Qt61zf
=+MB3
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html