Bugtraq mailing list archives
Re: Format String Attacks
From: Dan Harkless <dan-bugtraq () DILVISH SPEED NET>
Date: Fri, 15 Sep 2000 01:47:52 -0700
Dan Harkless <dan-bugtraq () DILVISH SPEED NET> writes:
Dan Harkless <dan-bugtraq () DILVISH SPEED NET> writes: [...]#!/usr/local/bin/perl # # wrap_setid_progs_with_envar_clearer[...] As I mentioned in my last post (assuming Aleph1 ends up approving it), I discovered a small problem in the first version of my script. If you had multiple setid programs that were hard links to each other (e.g. /usr/bin/{uptime,w} on Solaris 2.6), only one of them would get wrapped (though all would get defanged due to the nature of hard links).
[...] Sorry, yet another revision of this script is now available (probably the last change to be made). This probably isn't necessary anywhere, but just to be extra-paranoid, I changed the syscall error reporting to just print the numeric errno rather than trusting strerror() to not do anything bogus. I also changed the clearing of the environment variable(s) to be done manually (using main()'s third parameter) rather than trusting putenv(). Since the new version should be functionally identical to the last one, I won't waste more bandwidth by posting this rev. If you'd like it, you can get it from: http://harkless.org/dan/software/wrap_setid_progs_with_envar_clearer Well, now that I think about it, let me just post example wrapper code generated by the latest version of the script, in case anyone might spot any problems: #include <errno.h> /* for errno */ #include <stdio.h> /* for fprintf(), etc. */ #include <stdlib.h> /* for EXIT_FAILURE, etc. */ #include <unistd.h> /* for execve() */ #define ABSOLUTE_PATH_OF_WRAPPED_PROGRAM \ "/etc/lp/alerts/printer.wrapped_due_to_envar_security_hole" int main(int argc, char** argv, char** envp) { char** envp_ptr = envp; while (envp_ptr != NULL) { char* c; if (*envp_ptr == NULL) break; c = *envp_ptr; if ( *c++ == 'N' && *c++ == 'L' && *c++ == 'S' && *c++ == 'P' && *c++ == 'A' && *c++ == 'T' && *c++ == 'H' && *c++ == '=') *c = '\0'; envp_ptr++; } if (execve(ABSOLUTE_PATH_OF_WRAPPED_PROGRAM, argv, envp) != 0) { fprintf(stderr, "%s (wrapping " ABSOLUTE_PATH_OF_WRAPPED_PROGRAM "): execve() failed with errno = %d. Aborting.\n", argv[0], errno); exit(EXIT_FAILURE); } return EXIT_FAILURE; /* just here to quiet compiler warning */ } ---------------------------------------------------------------------- Dan Harkless | To prevent SPAM contamination, please dan-bugtraq () dilvish speed net | do not mention this private email SpeedGate Communications, Inc. | address in Usenet posts. Thank you.
Current thread:
- Format String Attacks Tim Newsham (Sep 12)
- Re: Format String Attacks Iván Arce (Sep 12)
- <Possible follow-ups>
- Re: Format String Attacks Doug Hughes (Sep 13)
- Re: Format String Attacks Dan Astoorian (Sep 14)
- Re: Format String Attacks Casper Dik (Sep 15)
- Re: Format String Attacks Pavel Kankovsky (Sep 14)
- Re: Format String Attacks Dan Harkless (Sep 14)
- Re: Format String Attacks Dan Harkless (Sep 14)
- Re: Format String Attacks Dan Harkless (Sep 14)
- Re: Format String Attacks Dan Harkless (Sep 15)
- Re: Format String Attacks Dan Harkless (Sep 17)
- Re: Format String Attacks Dan Astoorian (Sep 14)
- Re: Format String Attacks Drazen Kacar (Sep 14)
- Re: Format String Attacks Dan Harkless (Sep 14)
- Re: Format String Attacks Serguei Patchkovskii (Sep 14)
- Re: Format String Attacks Nate Eldredge (Sep 21)
- Re: Format String Attacks Matthias Meixner (Sep 22)
- Re: Format String Attacks jsl2 (Sep 22)
- Re: Format String Attacks Ajax (Sep 25)