-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 11.01.02: http://www.idefense.com/advisory/11.01.02.txt Buffer Overflow Vulnerability in Abuse October 31, 2002 I. BACKGROUND Abuse is a popular side-scrolling video game. More information can be found at http://jonathanclark.com/ and http://www.crack.com/. II. DESCRIPTION Exploitation of a locally exploitable parsing error in Abuse's "-net" command line option could allow attackers to gain root privileges on a targeted system. By supplying an overly long argument, the instruction pointer is overwritten, thereby allowing an attacker to seize control of the executable. In a default abuse installation in Debian Linux, both abuse.console and abuse.x11R6 can be used in exploitation; both files are set group id games, and abuse.console is set user id root. III. ANALYSIS Exploitation allows a local attacker to gain super-user status and full control over the targeted system. Affected users should implement either of the two workarounds listed below. IV. DETECTION Abuse 2.00, which is packaged and distributed with the x86 architecture of Debian Linux 3.0r0, is vulnerable. Other platforms and architectures may be vulnerable as well. To determine if a specific Abuse implementation is vulnerable, launch it with the following command line: $ /usr/lib/games/abuse/abuse.console -net 'perl -e 'print "A"x500'' If the application crashes with a "Segmentation fault", it is vulnerable. V. WORKAROUND Customers should consider implementing one of the two following workarounds: 1. Remove Abuse by issuing the following command: # apt-get remove abuse 2. Remove the setuid bit from the XaoS binary by executing the following command: # chmod -s /usr/lib/games/abuse/abuse.* VI. VENDOR RESPONSE "Abuse has a number of other vulnerabilities and should never be installed on a multi-user system where security is a concern," said Jonathan Clark. "Abuse allows alternate Lisp script files to be executed at startup via command line parameters. Some script functions can execute abritrary commands or cause external files to modified." VII. CVE INFORMATION The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project assigned the identification number CAN-2002-1250 to this issue. VIII. DISCLOSURE TIMELINE 10/15/2002 Issue disclosed to iDEFENSE 10/31/2002 Author notified 10/31/2002 iDEFENSE clients notified 11/01/2002 Response received from Jonathan Clark (jcat_private) 11/01/2002 Public disclosure IX. CREDIT Texonet (http://www.texonet.com) discovered this vulnerability. Get paid for security research http://www.idefense.com/contributor.html Subscribe to iDEFENSE Advisories: send email to listservat_private, subject line: "subscribe" About iDEFENSE: iDEFENSE is a global security intelligence company that proactively monitors sources throughout the world — from technical vulnerabilities and hacker profiling to the global spread of viruses and other malicious code. Our security intelligence services provide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 dendlerat_private www.idefense.com -----BEGIN PGP SIGNATURE----- Version: PGP 7.1.2 Comment: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4B0ACC2A iQA/AwUBPcLJckrdNYRLCswqEQKiIwCfYNMqgc3cz0u47KI072fQTtGqTN4An064 DlkW88VtmsQ+ZCyPWhAWnRms =tjox -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Fri Nov 01 2002 - 13:13:08 PST