Solaris Xlock Heap Overflow Vulnerability (Exploit, XUSERFILESEARCHPATH)
14 Aug. 2001
Summary
The NSFOCUS Security Team has found a heap buffer overflow vulnerability in the xlock shipped in Solaris system. This problem arises when handling some environment variables. Exploitation gives a local attacker root privileges.
Vulnerable systems:
Sun Solaris 2.6 (SPARC/x86)
Sun Solaris 7 (SPARC/x86)
Sun Solaris 8 (SPARC/x86)
Xlock is a screen-locking tool of Solaris OpenView. It locks the X server until a password is entered. It is installed suid root by default.
Due to a lack of boundary checking in some environment variable handling, an attacker could overwrite dynamic memory boundary of heap area, run arbitrary code as root with carefully constructed overflow data.
The problem is within these two environment variables: "XFILESEARCHPATH" and "XUSERFILESEARCHPATH". Xlock calls malloc() to allocate 1024 bytes memory and save the environment variable value in this dynamic memory. But xlock does not provide length check of environment variable when copying. In case that these two environment variables are set to be a string longer than 1024 bytes, a heap overflow might occur. Adjacent dynamic memory boundary tags could be overwritten, and segment fault would occur when malloc() is called next time. Some special "feature" of libc malloc()/free() implementation could be used to rewrite arbitrary memory like saved returned address and function pointer or other important data with carefully formed overflow data.
Exploiting this vulnerability successfully would give an attacker root privilege.
Exploit:
/*
* sol_x86_xlockex.c - Proof of Concept Code for xlock heap overflow bug.
* Copyright (c) 2001 - Nsfocus.com
*
* Tested in Solaris 8 x86.
*
* DISCLAIMS:
* This is a proof of concept code. This code is for test purpose
* only and should not be run against any host without permission from
* the system administrator.
*
* NSFOCUS Security Team <security@nsfocus.com>
* http://www.nsfocus.com
*/
execve(VULPROG, arg, env);
perror("execle");
return(1);
} /* End of main */
/*
* sol_sparc_xlockex.c - Proof of Concept Code for xlock heap overflow bug.
* Copyright (c) 2001 - Nsfocus.com
*
* Tested in Solaris 2.6/7/8 SPARC
*
* DISCLAIMS:
* This is a proof of concept code. This code is for test purpose
* only and should not be run against any host without permission from
* the system administrator.
*
* NSFOCUS Security Team <security@nsfocus.com>
* http://www.nsfocus.com
*/
env[0] = padding; /* put padding buffer in env */
env[1] = shellcode; /* put shellcode in env */
env[2] = buf; /* put overflow environ */
env[3] = NULL; /* end of env */
