AOLserver contains an exploitable buffer overflow as we reported in our previous article: AOLserver Authorization Buffer Overflow. The following is an exploit code that can be used by administrators to determine whether you are vulnerable.
Credit:
The information has been provided by qitest1.
Vulnerable systems:
AOLserver version 3.2 and prior
Immune systems:
AOLserver version 3.4 and above
Exploit:
/*
* AOLserver version 3.2 and prior Linux x86 remote exploit
* by qitest1 - Wed Sep 5 17:20:10 CEST 2001
*
* Proof of concept code for exploiting the bof in ParseAuth(). I
* used this vuln as a playground for some tests, all done on a RH6.2
* box. The fp will be overwritten by a pointer to a fake frame, with
* an fp and an eip pointing to the shellcode. Very unstable, segfault
* in most cases.
*
* Greets: grazer and the other hot guys on #!digit-labs
* teleh0r: come back home fratello! =)
*
* ..harder times for 0x69, now at http://digit-labs.org/qitest1..
*/
/* qitest1 and the pleasure of reading... ;pP
* This routine converts a buffer of bytes to/from RFC 1113
* printable encoding format.
* This technique is similar to the familiar Unix uuencode format
* in that it maps 6 binary bits to one ASCII character (or more
* aptly, 3 binary bytes to 4 ASCII characters). However, RFC 1113
* does not use the same mapping to printable characters as uuencode.
*
* Mark Riordan 12 August 1990 and 17 Feb 1991.
* This code is hereby placed in the public domain.
*
* Encode a single line of binary data to a standard format that
* uses only printing ASCII characters (but takes up 33% more bytes).
*/
int
Ns_HtuuEncode(unsigned char *bufin, unsigned int nbytes, char * bufcoded)
{
/*
* If nbytes was not a multiple of 3, then we have encoded too many
* characters. Adjust appropriately.
*/
if (i == nbytes + 1) {
/* There were only 2 bytes in that last group */
outptr[-1] = '=';
} else if (i == nbytes + 2) {
/* There was only 1 byte in that last group */
outptr[-1] = '=';
outptr[-2] = '=';
}
*outptr = '\0';
return (outptr - bufcoded);
}
