http://www.secnetops.biz/research -KF Secure Network Operations, Inc. http://www.secnetops.com Strategic Reconnaissance Team researchat_private Team Lead Contact kfat_private Our Mission: ************************************************************************ Secure Network Operations offers expertise in Networking, Intrusion Detection Systems (IDS), Software Security Validation, and Corporate/Private Network Security. Our mission is to facilitate a secure and reliable Internet and inter-enterprise communications infrastructure through the products and services we offer. Quick Summary: ************************************************************************ Advisory Number : SRT2003-05-08-1137 Product : ListProc Version : <= 8.2.09 Vendor : http://www.cren.net + http://www.listproc.net Class : local Criticality : Medium to Low Operating System(s) : Solaris 2.x, Linux, BSDI, FreeBSD, AIX High Level Explanation ************************************************************************ High Level Description : suid root catmail ULISTPROC_UMASK overflow What to do : chmod -s /path/to/catmail Technical Details ************************************************************************ Proof Of Concept Status : Secure Network Operations does have PoC code Low Level Description : In the middle of July last year The Corporation for Research and Educational Networking (CREN) was notified of a local buffer overflow in the program known as catmail. Catmail is a helper application for the mailing list server ListProc. ListProc is "the UNIX Mailing List Manager of choice" for a number of companies. On January 7, 2003 CREN has effectively ceased all operations including work with ListProc with the following statement: "We recommend that the Corporation for Research and Educational Networking (CREN) be dissolved effective as soon as appropriate. The effective date of dissolution will likely be in the first quarter of 2003. CREN Operations will cease effective as soon as appropriate." Prior to the company stopping operations SecNetOps was in contact with their development staff long enough to see that a fix was created for the above mentioned issue. Unfortunately at the time their staff was not on hand to thoroughly test the fix. SecNetOps did not have the facilities to compile the new version of catmail in efforts to test the fix on our own. The problem appeared to be caused by a series of strcat() sprintf() strcpy() and other easily abused function calls however we can not confirm that as fact. Currently ListProc has been moved to SourceForge however the status of this problem is not known. SecNetOps has not been in contact with CREN for a number of months. The current release on SourceForge has not been updated since March of 2002 so the fix is probably not available to the public. http://sourceforge.net/projects/listproc/ is the current home of ListProc. Zillion from Safemode.org was able to successfully exploit this problem in a SecNetOps lab setting. A functional exploit *may* be found at http://safemode.org. gentoo listproc $ head -n 12 List-Proc-catmail.pl #!/usr/bin/perl # # Quick hack for the ListProc catmail overflow found by KF (dotslashat_private) # Written by zillion (zillionat_private) on July 23, 2002 # # Tested on version 8.2.09 # # [zillion@ghetto lp8]$ ./expl.pl -f ./catmail # The new return address: 0xbfffae1c # sh-2.05# id # uid=0(root) gid=1214(snosoft) groups=1214(snosoft),520(zillion) The buffer overflow in ULISTPROC_UMASK may not be the only issues present. We would suggest evaluating a *supported* mailing list solution. Patch or Workaround : chmod -s /path/to/catmail Vendor Status : Status unknown. Fix was created but not distributed. Bugtraq URL : to be assigned ------------------------------------------------------------------------ This advisory was released by Secure Network Operations,Inc. as a matter of notification to help administrators protect their networks against the described vulnerability. Exploit source code is no longer released in our advisories. Contact researchat_private for information on how to obtain exploit information.
This archive was generated by hypermail 2b30 : Thu May 08 2003 - 10:23:40 PDT