Calife heap corrupt / potential local root exploit

2004-02-27T00:00:00
ID SECURITYVULNS:DOC:5842
Type securityvulns
Reporter Securityvulns
Modified 2004-02-27T00:00:00

Description

Calife heap corrupt / potential local root exploit

by Leon Juranic a.k.a DownBload <downbload@hotmail.com> / II-Labs

Version affected(tested): calife-2.8.4c and calife-2.8.5 - calife can be found at packages.debian.org, FreeBSD 5.0 (security), ...

>From `man calife`: ... Description: Calife requests user's own password for becoming login (or root, if no login is provided), and switches to that user and group ID after verify-ing proper rights to do so. A shell is then executed. If calife is exe-cuted by root, no password is requested and a shell with the appropriate user ID is executed. ...

[downbload@localhost downbload]$ ls -al `whereis calife` ls: calife:: No such file or directory -r-------- 1 root wheel 159 Feb 19 15:54 /etc/calife.auth -rwsr-xr-x 1 root wheel 575623 Feb 5 14:49 /usr/local/bin/calife

[downbload@localhost downbload]$ calife luser Password: "A" x 3000 Password: real_user_password Segmentation fault [downbload@localhost downbload]$

  • "A" x 3000 will corrupt the heap.
  • If real_user_password isn't correct, calife will do exit()
  • If attacker wants to exploit calife, there must be at least one user "available" in /etc/calife.auth

/root/calife-2.8.4c/db.c

    ...
    char    got_pass = 0;
    char    * pt_pass, * pt_enc,
            * user_pass, * enc_pass, salt [10];

    user_pass = &#40;char *&#41; xalloc &#40;l_size&#41;;
    enc_pass = &#40;char *&#41; xalloc &#40;l_size&#41;;
    ...
    for &#40; i = 0; i &lt; 3; i ++ &#41;
    {
        pt_pass = &#40;char *&#41; getpass &#40;&quot;Password:&quot;&#41;;
        memset &#40;user_pass, &#39;&#92;0&#39;, l_size&#41;;
        strcpy &#40;user_pass, pt_pass&#41;; // &lt;- BAD CODE
        pt_enc = &#40;char *&#41; crypt &#40;user_pass, calife-&gt;pw_passwd&#41;;
        memset &#40;enc_pass, &#39;&#92;0&#39;, l_size&#41;;
        strcpy &#40;enc_pass, pt_enc&#41;;
    }
    ...
    free &#40;user_pass&#41;;    // &lt;-  FUN CODE ;-&#41;
    free &#40;enc_pass&#41;;     // &lt;-  FUN CODE ;-&#41;
    ...

We can pass very long password string to calife and corrupt it's heap (overwrite boundary tags). However, it isn't easy to exploit this bug, because every newline, backspace, etc. character from user input will affect exploitation (e.g. backspace char will delete one char from user input - exploitation string).

Greetz to h4z4rd, BoyScout, finis, Fr1c, lucious, manikal, Gorans, slash, j0e, smak, Bojan, wootz...

Bye.