bugtraq - Solaris ld.so.1 buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030729203617.GG27022@ip212-226-112-140.kestel.pp.fi>
Date: Tue, 29 Jul 2003 23:36:18 +0300
From: Jouko Pynnonen <jouko@....fi>
To: bugtraq@...urityfocus.com
Subject: Solaris ld.so.1 buffer overflow

OVERVIEW
========

There is a buffer overflow vulnerability in the Solaris runtime linker, 
/lib/ld.so.1. A local user can gain elevated privileges if there are
any dynamically linked, executable SUID/SGID programs in the 
filesystem.

On a typical Solaris installation most or all SUID/SGID programs are 
dynamically linked. The trend has been to completely move towards 
dynamically linked binaries due to Sun's recommendation. Support for 
static binaries will be removed in Solaris 10.

DETAILS
=======

The environment variable LD_PRELOAD is used to force ld.so.1 to load 
the specified library during runtime linking. If a setuid or setgid 
program is being loaded, the value of this variable is checked to 
prevent a potential malicious user-defined library to be linked in. In 
this case the linker only accepts libraries located under certain 
trusted directories. The code doing this evaluation is most likely the 
point containing the "unchecked buffer".

The buffer overflow happens if the LD_PRELOAD value starts and ends 
with a slash and contains about 1200 characters. An exploit won't be 
presented here, but the existance of the vulnerability can be tested 
like this:

  $ LD_PRELOAD=/`perl -e 'print "A"x2000'` passwd
  ld.so.1: passwd: warning /AAAAAAA ... AAAAA/: open failed: illegal 
  insecure pathname
  Segmentation Fault (core dumped)

My test exploit for Solaris 9 / SPARC gets a root shell by setting 
the variable and starting /usr/bin/passwd. The exploit builds a fake 
stack frame and causes the linker to return to libc in order to defeat 
the nonexecutable stack protection. I haven't produced an exploit for 
Intel platform, but according to Sun the vulnerability exists on both 
platforms.

SOLUTION
========

Sun Microsystems was contacted on June 1st, 2003 and has released a fix 
for the flaw. A complete list of vulnerable Solaris versions and the 
fix can be found here:

  http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55680

CREDITS
=======

The vulnerability was discovered by Jouko Pynnönen, Finland.

-- 
Jouko Pynnonen          http://iki.fi/jouko/
jouko@....fi