[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20060125204350.6874.qmail@securityfocus.com>
Date: 25 Jan 2006 20:43:50 -0000
From: angelo@...iello.org
To: bugtraq@...urityfocus.com
Subject: Rosiello Security - Eterm-LibAST Advisory
Eterm-LibAST Advisory
Rosiello Security
http://www.rosiello.org
I. BACKGROUND
Eterm (http://www.eterm.org) is a color vt102 terminal emulator intended as an xterm(1) replacement. It is designed with a Freedom of Choice philosophy, leaving as much power, flexibility, and freedom as possible in the hands of the user. It is designed to look good and work well, but takes a feature-rich approach rather than one of minimalism. Eterm uses Imlib for advanced graphic abilities and includes LibAST.
II. DESCRIPTION
Eterm when builded links to LibAST. A stack overflow vulnerability exists in LibAST that allows an attacker to execute commands with user group “utmp”. The vulnerability is triggered when using an alternative configuration file name by the '-X' option. In this case Eterm will call conf_find_file() in conf.c from LibAST. Here is where vulnerability takes place at:
if (dir) {
strcpy(name, dir);
strcat(name, "/");
strcat(name, file);
}
III. ANALISYS
By exploiting this vulnerability an attacker can gain control of the return address of the executing function allowing arbitrary code execution with "utmp" group privileges.
IV. DETECTION
All vulnerable versions of Eterm using LibAST prior to 0.7 are vulnerable.
V. WORKAROUND
Rosiello Security is currently unaware of any workaround for this issue.
VI. VENDOR RESPONSE
The vendor has released the following new package of LibAST to fix the problem:
http://www.eterm.org/download/libast-0.7.tar.gz
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2006-0224 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
VIII. DISCLOSURE TIMELINE
15/01/2006 - Initial Vendor Contact
16/01/2006 – Initial Vendor Response
23/01/2006 – Coordinated public disclosure
IX. CREDITS
Johnny Mast from Rosiello Security (http://www.rosiello.org) is credited with discovering this vulnerability.
Rosiello Security home page: http://www.rosiello.org
You can find Rosiello Security's members in our irc server: irc.rosiello.net #rosiello
Visit our latest project Obsidis where you can find free security white papers: http://www.obsidis.org
X. LEGAL NOTICES
Copyright © 2006 Rosiello Security
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of Rosiello Security. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email angelo@...iello.org for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
Exploit: http://www.rosiello.org/archivio/eterm-exploit.c (Ubuntu with no random stack)
Powered by blists - more mailing lists