bugtraq - Re: Buffer overflow/privilege escalation in MacOS X

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <166CC2DF-3170-11D8-BECC-000393B86AE8@the-rileys.net>
Date: Thu, 18 Dec 2003 10:37:28 -0500
From: David Riley <oscar@...-rileys.net>
To: Max <rusmir@...a.net>
Cc: bugtraq@...urityfocus.com
Subject: Re: Buffer overflow/privilege escalation in MacOS X



On Dec 15, 2003, at 2:54 PM, Max wrote:

> Hi,
>
> It appears that parts of MacOSX that didn't come from BSD are
> not very well written and have significant security issues.
>
> An example is a /System/Library/Filesystems/cd9660.fs/cd9660.util
> utility. It is suid root and it is vulnerable to a classic buffer
> overflow due to the lack of input validation.
>
[snip]

> sdsx:/System/Library/Filesystems/cd9660.fs root# gdb -core 
> /cores/core.1405 ./cd9660.util
> [gdb banner here]
> Reading symbols for shared libraries .... done
> Core was generated by `./cd9660.util'.
> #0  0x9000d360 in strcat ()
> (gdb) where
> #0  0x9000d360 in strcat ()
> #1  0x00002b84 in main ()
> #2  0x41414141 in ?? ()

Unfortunately, I don't think this is exploitable.  main() would have to 
blr instead of making a system call to exit() for this to be 
exploitable.  Additionally, no other calls seem to call any exploitable 
functions like strcat or strcpy.  This would probably be exploitable if 
the function calling it wasn't main().

For what it's worth, the segfault comes from a bad access when strcat 
tries to read from 0x41414141 because its source vector gets 
overwritten by an earlier strcat (the destination vectors are stored 
earlier in memory and can't be overwritten, not that you'd be likely to 
be able to do anything with the overwritten vectors since there don't 
seem to be any places you can overwrite the stored link register value 
- main sticks it in a register, doesn't touch it, and in fact doesn't 
even use the saved value for returning, since it calls exit()).