Eterm LibAST Library缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1196270 漏洞类型 缓冲区溢出
发布时间 2006-01-23 更新时间 2006-12-13
CVE编号 CVE-2006-0224 CNNVD-ID CNNVD-200601-305
漏洞平台 N/A CVSS评分 4.6
|漏洞来源
https://www.securityfocus.com/bid/16350
https://cxsecurity.com/issue/WLB-2006010060
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200601-305
|漏洞详情
LibraryofAssortedSpiffyThings(LibAST)0.6.1及更早版本中的缓冲区溢出漏洞(用在Eterm和可能的其他软件中),可让本地用户通过长-X命令行参数(备用配置文件名)作为utmp用户执行任意代码。
|漏洞EXP
             Eterm-LibAST Advisory

Rosiello Security
           http://www.rosiello.org

I. BACKGROUND

Eterm (http://www.eterm.org) is a color vt102 terminal emulator intended as an xterm(1) replacement. It is designed with a Freedom of Choice philosophy, leaving as much power, flexibility, and freedom as possible in the hands of the user. It is designed to look good and work well, but takes a feature-rich approach rather than one of minimalism. Eterm uses Imlib for advanced graphic abilities and includes LibAST.

II. DESCRIPTION

Eterm when builded links to LibAST. A stack overflow vulnerability exists in LibAST that allows an attacker to execute commands with user group ?utmp?. The vulnerability is triggered when using an alternative configuration file name by the '-X' option. In this case Eterm will call conf_find_file() in conf.c from LibAST. Here is where vulnerability takes place at:

if (dir) {

strcpy(name, dir);

strcat(name, "/");

strcat(name, file);

}

III. ANALISYS

By exploiting this vulnerability an attacker can gain control of the return address of the executing function allowing arbitrary code execution with "utmp" group privileges.

IV. DETECTION

All vulnerable versions of Eterm using LibAST prior to 0.7 are vulnerable.

V. WORKAROUND

Rosiello Security is currently unaware of any workaround for this issue.

VI. VENDOR RESPONSE

The vendor has released the following new package of LibAST to fix the problem:

http://www.eterm.org/download/libast-0.7.tar.gz

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2006-0224 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.

VIII. DISCLOSURE TIMELINE

15/01/2006 - Initial Vendor Contact

16/01/2006 ? Initial Vendor Response

23/01/2006 ? Coordinated public disclosure

IX. CREDITS

Johnny Mast from Rosiello Security (http://www.rosiello.org) is credited with discovering this vulnerability.

Rosiello Security home page: http://www.rosiello.org

You can find Rosiello Security's members in our irc server: irc.rosiello.net #rosiello

Visit our latest project Obsidis where you can find free security white papers: http://www.obsidis.org

X. LEGAL NOTICES

Copyright © 2006 Rosiello Security

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of Rosiello Security. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email angelo (at) rosiello (dot) org [email concealed] for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

Exploit: http://www.rosiello.org/archivio/eterm-exploit.c  (Ubuntu with no random stack)
|受影响的产品
Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 LibAST LibAST 0.6.1 LibAST LibAST 0.6 LibAST LibAST 0.5 LibAST LibAST 0.4 Gentoo Lin
|参考资料

来源:BUGTRAQ
名称:20060123[RosielloSecurity]Eterm-LibASTAdvisory
链接:http://www.securityfocus.com/archive/1/archive/1/423207/100/0/threaded
来源:BUGTRAQ
名称:20060125RosielloSecurity-Eterm-LibASTAdvisory
链接:http://www.securityfocus.com/archive/1/archive/1/423088/100/0/threaded
来源:MISC
链接:http://www.rosiello.org/en/read_bugs.php?id=25
来源:VUPEN
名称:ADV-2006-0314
链接:http://www.frsirt.com/english/advisories/2006/0314
来源:BID
名称:16350
链接:http://www.securityfocus.com/bid/16350
来源:BUGTRAQ
名称:20060123LibAST0.7ReleaseFixesSecurityVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/423366/100/0/threaded
来源:freshmeat.net
链接:http://freshmeat.net/projects/libast/?branch_id=17907&release_id=217840
来源:freshmeat.net
链接:http://freshmeat.net/projects/libast/?branch_id=17907&release_id=217840
来源:XF
名称:eterm-libast-filename-bo(24303)
链接:http://xforce.iss.net/xforce/xfdb/24303
来源:OSVDB
名称:22735
链接:http://www.osvdb.org/22735
来源:MANDRIVA
名称:MDKSA-2006:029
链接:http://www.mandriva.com/security/advisories?na