|
|
|
|
| |
| Solaris is a UNIX operating system developed by Sun Microsystems. Local exploitation of a directory traversal vulnerability in ld.so could potentially allow a non root user to execute arbitrary code as root. |
| |
Credit:
The information has been provided by iDefense Labs Security Advisories.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=449
|
| |
Vulnerable Systems:
* Solaris 10 for both x86 and SPARC
ld.so uses the environmental variables LANG, LC_ALL, and LC_MESSAGES to determine what locale is currently set. When ld.so encounters an error, such as when a non root user specifies an unsafe library in the LD_PRELOAD environmental variable, it uses one of the above variables to open up a message file that contains error strings. It will make a call like this to open the file:
open("/usr/lib/locale/$LANG/LC_MESSAGES/SUNW_OST_SGS.mo",..)
$LANG is a user controlled environmental variable that is not sanitized. This message file is meant to contain format strings used to build error messages, and should therefore only be writable by root. By setting LANG to a value such as "../../../../../home/user" an attacker can control the the location of this message file, and pass arbitrary format strings to a printf() like function in ld.so.
Analysis:
Successful local exploitation allows attackers to execute arbitrary code as root on the affected host.
ld.so does not use the C library printf() function; it has it's own minimal implementation. This implementation does not provide the %n format specifier. Therefore an attacker is limited to leaking information through such specifiers as %x. However, while researching this vulnerability it was found that the formatting function itself also contains a buffer overflow vulnerability that can be triggered with a user controlled format string. This vulnerability is discussed in a separate iDefense advisory. By combining these two vulnerabilities it is possible that an attacker could execute arbitrary code as root.
Vendor Response:
Sun Microsystems has addressed this problem with new patches. More information can be found in Sun Alert #102724. This alert can be found at: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102724-1
Disclosure Timeline:
10/24/2006 - Initial vendor notification
10/27/2006 - Initial vendor response
12/12/2006 - Coordinated public disclosure
|
|
|
|
|
