The pthread library (libpthread) provides "interfaces for developing multi-threaded applications". libpthread suffers from a buffer overflow vulnerability which may enable an attacker to execute arbitrary commands on the system. This vulnerability may potentially be exploited by a creating a specially crafted buffer and inserting it into the PTHREAD_CONFIG variable.
Vulnerable Systems:
* libpthread version 5.1b (HPUX)
libpthread reads in the PTHREAD_CONFIG environment variable. It may be possible to exploit libpthread on HP's tru64 by creating a specially crafted buffer. The details below do not contain the specially crafted buffer. Exploitation of this specific vulnerability is very difficult.
#############################################
#
# Insert 273 A's (41) into the PTHREAD_CONFIG variable
#
#############################################
#############################################
#
# Run newaliases in gdb with the -q flag.
#
#############################################
bash-3.00# gdb /tmp/newaliases -q
(no debugging symbols found)...(gdb) r
Starting program: /tmp/newaliases
(no debugging symbols found)... (no debugging symbols found)... (no debugging symbols found)... (no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
0x3ff805c8bf8 in __putString () from /usr/shlib/libpthread.so
#############################################
#
# Execute a back trace (bt) within gdb
#
#############################################
(gdb) bt
#0 0x3ff805c8bf8 in __putString () from /usr/shlib/libpthread.so
#1 0x3ff805c8a78 in __putFormatEol () from /usr/shlib/libpthread.so
#2 0x3ff805bc4f8 in __utlOptManage () from /usr/shlib/libpthread.so
warning: Hit heuristic-fence-post without finding
warning: enclosing function for address 0x4141414141414141
This warning occurs if you are debugging a function without any symbols (for example, in a stripped executable). In that case, you may wish to increase the size of the search with the `set heuristic-fence-post' command.
Otherwise, you told GDB there was a function where there isn't one, or (more likely) you have encountered a bug in GDB.
###############################################
#
# The following registers, a0, a1, a2, a3, a4, a5, have been
# overwritten with A's (0x41).
#
###############################################
############################################
#
# Other binaries which are linked agianst libpthread.so
# will also segfault when the PTHREAD_CONFIG variable
# is set to a large string of A's. The following is
# a list of some of those binaries
#
############################################
