RE: openbsd 3.4 ps bug

From: Dom De Vitto (dom_at_DeVitto.com)
Date: 11/20/03

  • Next message: Aaron Adams: "Linux Kernel <= 2.4.21 MXCSR Local DOS Exploitation" 
    To: <vuln-dev@securityfocus.com>
Date: Thu, 20 Nov 2003 21:59:41 -0000

    I personally think it's interesting that ps does not appear to be
    well formed (as other, setuid/gid) processes could share this issue,
    however Kurt's point is valid - if there is no elevation of privilege,
    this is not a 'security bug'.

    Dom
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Dom De Vitto Tel. 07855 805 271
    http://www.devitto.com mailto:dom@devitto.com
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    -----Original Message-----
    From: Kurt Seifried [mailto:bt@seifried.org]
    Sent: Thursday, November 20, 2003 9:52 AM
    To: thanos F@rm@k1s; vuln-dev@securityfocus.com
    Subject: Re: openbsd 3.4 ps bug

    > Security bug for openbsd 3.4
    >
    > While i was testing my new openbsd 3.4 i found the following problem.
    > First of all i have the OpenBSD3.4 FUlly patched with all the latest
    > fixes in an i386 machine (P3 128mb ram).Some of the ports were
    > installed too(From the oficial 3cd set which i bought).While i was
    > playing with the command ps i found the following which i have tested
    > it in two machines
    with
    > four different kernels(2 patched and 2 unpatched).The utility ps has a
    flaw
    > when used with the bash shell.Go to your root(/) directory or any dir
    > that contains more then two files or directorys and give the command
    > ps -p * or ps -N * or ps -M * and you will instantly see a core dump
    > file in your
    dir.
    > The ps program is giving us a signal (SIGSEGV).Please try all the
    > above
    args
    > more then two times and first in your root dir.When i tried to confirm
    > it
    with
    > the gdb it gave me the address 0x1c01c116 in ?? ().I don`t have the
    > time to confirm if the bug is exploitable or not but it is a big
    > problem because a user(id 1000+) can also do that.This is a report
    > which will also be submited in the bugtraq.It is also not confirmed
    > that other versions
    are
    > vulnerable to this bug.This bug can only be reproduced when bash2 is
    installed
    > (from the official ports package) and a in a dir where more then two
    > files
    exists.
    > Sorry for the bad englis.
    >
    > The openbsd team has been informed.

    Yes this creates a core dump. I fail to see how this is exploitable for
    additional privileges however as ps is not setuid/setgid (simply mode 0555).
    Can you please enlighten us as to how this is exploitable for additional
    privileges?

    Kurt Seifried, kurt@seifried.org
    A15B BEE5 B391 B9AD B0EF
    AEB0 AD63 0B4E AD56 E574
    http://seifried.org/security/

  • Next message: Aaron Adams: "Linux Kernel <= 2.4.21 MXCSR Local DOS Exploitation"

    Relevant Pages

    • Re: openbsd 3.4 ps bug
      ... > Security bug for openbsd 3.4 ... > While i was testing my new openbsd 3.4 i found the following problem. ... > time to confirm if the bug is exploitable or not but it is a big problem ... additional privileges however as ps is not setuid/setgid. ...
      (Vuln-Dev)
    • More VMS pantomime :-( Re: DEFCON 16 and Hacking OpenVMS
      ... I imagine that this vulnerability would be a one-off ... Authorized privileges: ... IF the bug actually is exploitable. ... We often use a simple shellcode/payload for testing as a first step in ...
      (comp.os.vms)
    • Re: DEFCON 16 and Hacking OpenVMS
      ... Authorized privileges: ... IF the bug actually is exploitable. ... question marks for any vulnerability hunter. ... We often use a simple shellcode/payload for testing as a first step in ...
      (comp.os.vms)
    • Re: [Full-Disclosure] openssh exploit code?
      ... Can you provide any sort of technical argument as to why this bug is not ... Or are you going to simply stand behind the typical OpenBSD ... So yeah, FUD. ... provide an adequate technical discussion against the exploitability of ...
      (Full-Disclosure)
    • Re: Apache root exploitable?
      ... it has been confirmed/checked to work on OpenBSD 3.0. ... stating that the exploit is indeed applicable to FreeBSD ... Apache 1.3.20, but perhaps the author of the vulnerability would like to ... * The "experts" have already concurred that this bug... ...
      (FreeBSD-Security)