openbsd 3.4 ps bug

From: thanos F_at_rm@k1s (F_at_rm@k1s)
Date: 11/19/03

  • Next message: noir: "Re: GetPC code (was: Shellcode from ASCII)"
    Date: 19 Nov 2003 19:20:27 -0000
    To: vuln-dev@securityfocus.com
    
    
    ('binary' encoding is not supported, stored as-is)

    Security bug for openbsd 3.4

    While i was testing my new openbsd 3.4 i found the following problem.
    First of all i have the OpenBSD3.4 FUlly patched with all the latest
    fixes in an i386 machine (P3 128mb ram).Some of the ports were installed
    too(From the oficial 3cd set which i bought).While i was playing with the
    command ps i found the following which i have tested it in two machines with
    four different kernels(2 patched and 2 unpatched).The utility ps has a flaw
    when used with the bash shell.Go to your root(/) directory or any dir that
    contains more then two files or directorys and give the command ps -p * or
    ps -N * or ps -M * and you will instantly see a core dump file in your dir.
    The ps program is giving us a signal (SIGSEGV).Please try all the above args
    more then two times and first in your root dir.When i tried to confirm it with
    the gdb it gave me the address 0x1c01c116 in ?? ().I don`t have the
    time to confirm if the bug is exploitable or not but it is a big problem
    because a user(id 1000+) can also do that.This is a report which will also
    be submited in the bugtraq.It is also not confirmed that other versions are
    vulnerable to this bug.This bug can only be reproduced when bash2 is installed
    (from the official ports package) and a in a dir where more then two files exists.
    Sorry for the bad englis.

    The openbsd team has been informed.


  • Next message: noir: "Re: GetPC code (was: Shellcode from ASCII)"