Secure Network Operations, Inc.           http://www.secnetops.com
Strategic Reconnaissance Team               research@secnetops.com
Team Lead Contact                                 kf@secnetops.com


Our Mission:
************************************************************************
Secure Network Operations offers expertise in Networking, Intrusion
Detection Systems (IDS), Software Security Validation, and
Corporate/Private Network Security. Our mission is to facilitate a
secure and reliable Internet and inter-enterprise communications
infrastructure through the products and services we offer.


Quick Summary:
************************************************************************
Advisory Number         : SRT2003-04-03-1300
Product                 : Interbase Database
Version                 : IB6.x
Vendor                  : borland.com
Class                   : local
Criticality             : High (to Interbase users)
Operating System(s)     : Linux (tested)


High Level Explination
************************************************************************
High Level Description  : ISC_LOCK_ENV variable overflow
What to do              : fix strcat() call in gds.c or chmod -s gds_lock_mgr

Technical Details
************************************************************************
Proof Of Concept Status : We have working PoC for the described situation
Low Level Description   :

The Interbase gds_lock_mgr checks for the ISC_LOCK_ENV upon init. This
variable has been defined as "INTERBASE_LOCK". If the ISC_LOCK_ENV is
over 1024 chars in length a segfault will occur. We have successfuly
exploited this issue and have been able to run our own shellcode.

This problem lies in one of many strcat() calls in gds.c:

./common.h:#define MAXPATHLEN      1024
./gds.c:714:#define ISC_LOCK_ENV    "INTERBASE_LOCK"
./gds.c:425:static char ib_prefix_lock_val[MAXPATHLEN];

void API_ROUTINE gds__prefix_lock (
    TEXT        *string,
    TEXT        *root)
/********************************************************
 *
 *      g d s _ $ p r e f i x _ l o c k ( n o n - V M S )
 *
 ********************************************************
 *
 * Functional description
 *      Find appropriate InterBase lock file prefix.
 *      Override conditional defines with the enviroment
 *      variable INTERBASE_LOCK if it is set.
 *
 **************************************/
string [0] = 0;

if (ib_prefix_lock == NULL)
    {
    if (!(ib_prefix_lock = getenv (ISC_LOCK_ENV)))
        {
        ib_prefix_lock = ib_prefix_lock_val;
        gds__prefix(ib_prefix_lock, "");
        }
    else
        {
        strcat (ib_prefix_lock_val, ib_prefix_lock); // PROBLEM HERE
        ib_prefix_lock = ib_prefix_lock_val;
        }
    }


During exploit development we ran into one setback. The result was the
lack of an interactive shell. We instead run a program of in /tmp.

 [elguapo@rh8 tmp]$ cat sh.c
 main(){setuid(0);setgid(0);system("/usr/bin/id > /tmp/SNO");}
 [elguapo@rh8 tmp]$ cc -o sh sh.c
 [elguapo@rh8 tmp]$ id
 uid=500(elguapo) gid=500(elguapo) groups=500(elguapo)
 [elguapo@rh8 tmp]$ ls -al ./gds_lock_mgr
 -rwsr-sr-x    1 root     root       116723 Nov 26 20:31 ./gds_lock_mgr
 [elguapo@rh8 tmp]$ ./gds_lock_mgr_ex.pl
 [elguapo@rh8 tmp]$ cat SNO
 uid=0(root) gid=0(root) groups=500(elguapo)


Patch or Workaround     : chmod -s /path/to/gds_lock_mgr or
edit the above mentioned strcat() call in gds__prefix_lock() from ./gds.c
to make use of strncat().

strncat (ib_prefix_lock_val, ib_prefix_lock, sizeof(ib_prefix_lock_val)-1);

Vendor Status   : Borland was emailed several months ago. As with previous
security contact to Borland no response was provided by the vendor.

Bugtraq URL     : not yet assigned.

------------------------------------------------------------------------
This advisory was released by Secure Network Operations,Inc. as a matter
of notification to help administrators protect their networks against
the described vulnerability. Exploit source code is no longer released
in our advisories. Contact research@secnetops.com for information on how
to obtain exploit information.