Bugtraq mailing list archives
man bugs might lead to root compromise (RH 6.1 and other boxes)
From: lcamtuf () DIONE IDS PL (Michal Zalewski)
Date: Sat, 26 Feb 1994 13:48:35 +0100
With most of Linux distributions, /usr/bin/man is shipped as setgid man. This setgid bit is required to build formatted manpages in /var/catman for faster access. Unfortunately, man does almost everything via system() calls, where parameters are user-dependent, and almost always it's sprintf'ed before to fixed size buffers. It's kinda trivial to gain man privledges, using buffer overflows in enviromental variables. For example, by specyfing MANPAGER variable with approx 4k 'A' letters, you'll get SEGV: $ MANPAGER=`perl -e '{print "A"x4000}'` man ls [...] 1200 setuid(500) = 0 1200 setgid(15) = 0 1200 open("/usr/share/locale/pl/man", O_RDONLY) = -1 ENOENT (No such file or directory) 1200 open("/usr/share/locale/pl/LC_MESSAGES/man", O_RDONLY) = -1 ENOENT (No such file or directory)1200 open("/usr/share/locale/pl/man", O_RDONLY) = -1 ENOENT (No such file or directory) 1200 open("/usr/share/locale/pl/LC_MESSAGES/man", O_RDONLY) = -1 ENOENT (No such file or directory)1200 close(-1) = -1 EBADF (Bad file descriptor) 1200 write(2, "Error executing formatting or display command.\nSystem command (cd /usr/man ; (echo 1200 --- SIGSEGV (Naruszenie ochrony pamiêci) --- 1200 +++ killed by SIGSEGV +++ Program received signal SIGSEGV, Segmentation fault. 0x41414141 in ?? () As you can see, SEGV occours when we're at privledged level (after setgid man) and is trivially exploitable (generic stack overflow). What then? We have 'man' privledges and write access to /var/catman directory tree (less interesting, can be used to mess around with man output), and, usually, to some /usr/man files (it shouldn't be possible, but some compilers, like cpp, and programs like fetchmail, for some reasons have g+w manpages on many systems). Days ago, Pawel Wilk described possible vulnerability in manpage processing - execution of arbitrary code when evil manpage is being browsed... Sample manpage is available at: ftp://dione.ids.pl/people/siewca/security/man/mkroot.9 So, if you have write access to some manpages, and root uses man, there's a chance to gain root privledges. If not, only lusers are affected. I have no information on other Unices, except for *BSD, where it seems to be patched days ago, and SunOS, which seems to be vulnerable, but isn't setuid/setgid (am I right? only one system tested). Solution: remove sgid bit from /usr/bin/man (it will be no longer creating preformatted manpages in /var/catman), or rewrite major portions of 'man' code. _______________________________________________________ Michal Zalewski * [lcamtuf () ags pl] <=> [AGS WAN SYSADM] [dione.ids.pl SYSADM] <-> [http://lcamtuf.na.export.pl] [+48 22 551 45 93] [+48 603 110 160] bash$ :(){ :|:&};: =-----=> God is real, unless declared integer. <=-----=
Current thread:
- EZ Shopper 3.0 shopping cart CGI remote command execution, (continued)
- EZ Shopper 3.0 shopping cart CGI remote command execution suid () SUID KG (Feb 27)
- Re: EZ Shopper 3.0 shopping cart CGI remote command execution Alex Heiphetz (Feb 28)
- W2K & ~25000+ temp files = crash + corruption? Clifford Hammerschmidt (Feb 28)
- ALERT!: TendMicro InterScan (DOS & intrusion) Veille Technologique (Feb 28)
- Advisory: Foundry Networks ServerIron TCP/IP sequence predictability Andrew van der Stock (Feb 27)
- Zonealarm exports sensitive data Andrew Daviel (Feb 24)
- Re: Zonealarm exports sensitive data Brett Glass (Feb 25)
- Re: Zonealarm exports sensitive data Robert Graham (Feb 28)
- Re: Wordpad vulnerability, exploitable also in IE for Win9x Curtis Anderson, CNE, MCSE (Feb 25)
- Troj_Trinoo and ZZ Simple Nomad (Feb 25)
- man bugs might lead to root compromise (RH 6.1 and other boxes) Michal Zalewski (Feb 26)
- Re: man bugs might lead to root compromise (RH 6.1 and other boxes) Mark Whitis (Feb 27)
- Re: man bugs might lead to root compromise (RH 6.1 and other boxes) H D Moore (Feb 27)
- Re: man bugs might lead to root compromise (RH 6.1 and other boxes) Michal Zalewski (Feb 28)
- Re: man bugs might lead to root compromise (RH 6.1 and other boxes) H D Moore (Feb 28)
- DOS in TrendMicro OfficeScan Veille Technologique (Feb 28)
- TrendMicro OfficeScan tmlisten.exe DoS Jeff Stevens (Feb 25)
- Re: Troj_Trinoo and ZZ Simple Nomad (Feb 26)