Re: [Full-Disclosure] [SECURITY] [DSA 139-1] New super packages fix local root exploit

gobbles_at_hushmail.com
Date: 06/21/04

  • Next message: infamous41md_at_hotpop.com: "linux kernel IEEE1394(Firewire) driver integer overflow vulnerabilities" 
    Date: Mon, 21 Jun 2004 06:02:21 -0700
To: full-disclosure@lists.netsys.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Hi list!@ hehehehe ;PPpPPPPPp

    It appear Max Vozeler who wrap he packages for he debian friends did
    travel back in time with he timemachine of many speed. Friend GOBBLES
    not buy into whole space/time discussion ;PPpPPPP But anyways here
    is friend GOBBLES of old! From he hushmail electronic mail of 2002.

    Look here:
    http://lists.netsys.com/pipermail/full-disclosure/2004-June/022831.html

    GOBBLES did read:

       Package : super
       Vulnerability : format string
       Problem-Type : remote
       Debian-specific: no
       CVE Ids : CAN-2004-0579

       Max Vozeler discovered a format string vulnerability in super, a
       program to allow specified users to execute commands with root
       privileges. This vulnerability could potentially be exploited by
    a
       local user to execute arbitrary code with root privileges.

    Probably smart to remember ripping published advisory that get small
    bit
    of mediocre media attention come back to bite you in the ass (related
    to
    ***, not mule hehehehe) but GOBBLES say that all in the behind!

    Now GOBBLES pioneer many things and he appreciate new pioneering when
    it not stale, so observe many fast patching here in Max patch:

       --- super-3.16.1.orig/error.c
       +++ super-3.16.1/error.c
       @@ -168,12 +168,12 @@
        void rsyslog P__(( unsigned int level, char *fmt, ... ));

        #define OpenLog(prog, opt, fac) ropenlog((prog), (opt), (fac), error_rlog_host)
       -#define SysLog(pri, buf) rsyslog((pri), (buf))
       +#define SysLog(pri, buf) rsyslog((pri), "%s", (buf))

        #else

        #define OpenLog(prog, opt, fac) openlog((prog), (opt), (fac))
       -#define SysLog(pri, buf) syslog((pri), (buf))
       +#define SysLog(pri, buf) syslog((pri), "%s", (buf))

        #endif

    Ding ding ding! Deja vu. GOBBLES would like to point out he 2002
    fame in 2002 (year of turkey):

    http://lists.netsys.com/pipermail/full-disclosure/2002-July/000308.html

        * Problem:
        *
        * When super is compiled to use syslog(3) for its logging
        * of error messages the following lines makes pre-auth
        * local root exploitation rather trivial:
        *
        * From error.c
        * ...
        * #define SysLog(pri, buf) syslog((pri), (buf))
        * ...
        * SysLog(error_priority, buf);
        * ...
        *
        * This means users that are not in the super config file
        * will be able to execute code with root priviledges.
        *
        * "Super acts as a SetUID wrapper around system commands
        * to make sure the commands are executed safely, and
        * only by authorized users."
        *
        * hehehe ;PPpPPPPp
        *
        * Love,
        * GOBBLES

    GOBBLES would like to take this opportunity to thank Max for celebrating
    the two year aniversary of the SUPER bug. Thanks friend Max, you get
    free t-shirt at defcon 2002 ;pPPpPPPpPP

    For special bonus treat see debian patch history. GOBBLES wonder who
    keep backdoor in anti-spam stale linux alive!? It a mystery!

    References:
    http://www.debian.org/security/2002/dsa-139
    http://www.debian.org/security/2004/dsa-522

    Debian project recommend replacing backdoored super program with new
    version. GOBBLES would rather like to recommend concerned security
    professional to replace Debian with better Linux, like 7350 Linux.
    German friend at 7350 Linux Inc. is good at patching the many
    GOBBLES bugs in he Linux.

    Friend GOBBLES also need to take time to point out old Security
    Focus page is outdated and urgently has to be updated to reflect
    this mysterious bug!
    Outdated web page is here: http://www.securityfocus.com/bid/5367

    Love,
    GOBBLES
    GOBBLES@hushmail.com
    -----BEGIN PGP SIGNATURE-----
    Note: This signature can be verified at https://www.hushtools.com/verify
    Version: Hush 2.4

    wkYEARECAAYFAkDW3FsACgkQHNGnlyGZsA88vACfZ1zGct4qQ6EXJa8/EFtYDcNrif4A
    oI3dqVSASPtpU6mazvKRS+Qt61zf
    =+MB3
    -----END PGP SIGNATURE-----

  • Next message: infamous41md_at_hotpop.com: "linux kernel IEEE1394(Firewire) driver integer overflow vulnerabilities"
    • Quantcast