Despite the fact that Georgi Gunski found a buffer overflow in dtaction in 1997, no-one apparently checked dtaction any further. The overflow that was discovered then appeared to be due to a bug in the shared library libDtSvc.so, which was subsequently fixed. Even though the Sun Security Bulletin 164 at that time said:
Due to insufficient bounds checking on arguments supplied to dtaction, it is possible to overwrite the internal stack space of dtaction. As dtaction is setuid root, this vulnerability may be exploited to gain root access.
Apparently not all user-supplied arguments were checked.
Supplying a username over 1024 with the argument -user will overflow an internal buffer used to log a message to /var/adm/sulog. Although the overflow can succeed, a message will always be logged to /var/adm/sulog.
The overflow is in a function called AddSuLog, which is called from a function LogFailure, which in turn is called from a function UnknownUser:
The code at the end of the routine UnkownUser() looks like this (all on Solaris 2.6):
According to the description of XtAppMainLoop, it will never return. This will make the overflow not exploitable on systems where the return address on the stack is for the caller of the caller (like sparc). However, when we inspect the function XtAppMainLoop on Solaris 2.6 we find:
It seems that this function might end if a certain test fails. It is unclear if this is a test under control of the user.
Below is a simple C program which shows the problem on Solaris 7 x86, which has a stack with the return address of the caller on it.
/*
* dtaction_ov.c
* Job de Haas
* (c) ITSX bv 1999
*
* This program demonstrates an overflow problem in /usr/dt/bin/dtaction.
* It has only been tested on Solaris 7 x86
* assembly code has been taken from ex_dtprintinfo86.c by unewn4th@usa.net
*
*/
/* set some pointers to values that keep code running */
p = (unsigned long *)&buf[buflen];
*p++ = 0x37dc779b;
*p++ = 0xdfaf6502;
*p++ = 0x08051230;
*p++ = 0x080479b8;
Possible Workaround:
dtaction allows local or remote invocation of an 'Action' as any user. This is why dtaction is setuid root. If this feature is not needed the setuid bits can be removed:
as root type: chmod 555 /usr/dt/bin/dtaction
dtaction can then still be used to invoke local and remote 'Actions' as the user invoking dtaction.
Affected systems:
Although the overflow is present in most implementations, exploiting it is very much system dependent.
The only systems that were verified to contain the mentioned vulnerability were:
Solaris 7, 2.6, 2.5.1
