Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Calife Buffer Overflow May Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1009245
|
|
CVE Reference: CAN-2004-0188
(Links to External Site)
|
Updated: Mar 4 2004
|
Original Entry Date: Feb 27 2004
|
Impact: Execution of arbitrary code via local system, Root access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 2.8.6
|
Description: A heap overflow vulnerability was reported in Calife. A local user may be able to gain root privileges on the target system.
Leon Juranic (DownBload) reported that a local user can supply a long, specially crafted password to the application to trigger a
segmentation fault and potentially execute arbitrary code with root privileges.
A demonstration exploit transcript is provided:
[downbload@localhost
downbload]$ calife luser
Password: "A" x 3000
Password: real_user_password
Segmentation fault
According to the report, there
must be at least one user "available" in '/etc/calife.auth' to exploit this flaw.
The flaw reportedly resides in 'db.c'.
The
vendor reported that on FreeBSD, the FreeBSD getpass(3) function performs the length validation but that on Linux, no length validation
is performed.
|
Impact: A local user may be able to execute arbitrary code with root privileges [the report mentions but does not explicitly confirm that impact].
|
Solution: The vendor has released a fixed version (2.8.6), available at:
ftp://ftp.frmug.org/pub/calife/latest.tar.gz
|
Vendor URL: mutt.frmug.org/calife/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: DownBload <downbload@hotmail.com>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: 27 Feb 2004 09:19:21 -0000
From: DownBload <downbload@hotmail.com>
Subject: Calife heap corrupt / potential local root exploit
|
Calife heap corrupt / potential local root exploit
--------------------------------------------------
by Leon Juranic a.k.a DownBload <downbload@hotmail.com> / II-Labs
Version affected(tested): calife-2.8.4c and calife-2.8.5
- calife can be found at packages.debian.org, FreeBSD 5.0 (security), ...
>From `man calife`:
...
Description:
Calife requests user's own password for becoming login (or root, if no login is provided), and s
witches to that user and group
ID after verify-ing proper rights to do so. A shell is then executed. If calife is exe-cuted by ro
ot, no password is requested
and a shell with the appropriate user ID is executed.
...
[downbload@localhost downbload]$ ls -al `whereis calife`
ls: calife:: No such file or directory
-r-------- 1 root wheel 159 Feb 19 15:54 /etc/calife.auth
-rwsr-xr-x 1 root wheel 575623 Feb 5 14:49 /usr/local/bin/calife
[downbload@localhost downbload]$ calife luser
Password: "A" x 3000
Password: real_user_password
Segmentation fault
[downbload@localhost downbload]$
- "A" x 3000 will corrupt the heap.
- If real_user_password isn't correct, calife will do exit()
- If attacker wants to exploit calife, there must be at least one user "available" in /etc/
calife.auth
/root/calife-2.8.4c/db.c
------------------------
...
char got_pass = 0;
char * pt_pass, * pt_enc,
* user_pass, * enc_pass, salt [10];
user_pass = (char *) xalloc (l_size);
enc_pass = (char *) xalloc (l_size);
...
for ( i = 0; i < 3; i ++ )
{
pt_pass = (char *) getpass ("Password:");
memset (user_pass, '\0', l_size);
strcpy (user_pass, pt_pass); // <- BAD CODE
pt_enc = (char *) crypt (user_pass, calife->pw_passwd);
memset (enc_pass, '\0', l_size);
strcpy (enc_pass, pt_enc);
}
...
free (user_pass); // <- FUN CODE ;-)
free (enc_pass); // <- FUN CODE ;-)
...
------------------------
We can pass very long password string to calife and corrupt it's heap (overwrite boundary tags).
However, it isn't easy to exploit this bug, because every newline, backspace, etc. character from use
r input will affect exploitation
(e.g. backspace char will delete one char from user input - exploitation string).
Greetz to h4z4rd, BoyScout, finis, Fr1c, lucious, manikal, Gorans, slash, j0e, smak, Bojan, wootz...
Bye.
|
|
Go to the Top of This SecurityTracker Archive Page
|
