exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Netragard Security Advisory 2006-08-10

Netragard Security Advisory 2006-08-10
Posted Nov 13, 2006
Authored by Netragard | Site netragard.com

Netragard, L.L.C Advisory NETRAGARD-20060810 - libpthread suffers from a buffer overflow vulnerability which may enable an attacker to execute arbitrary commands on the system. This vulnerability may potentially be exploited by a creating a specially crafted buffer and inserting it into the PTHREAD_CONFIG variable. Version 5.1b is affected.

tags | advisory, overflow, arbitrary
SHA-256 | 987de219a762a82acd64d995906ea3a9208ed3a544ba195b808c097d325cf8e8

Netragard Security Advisory 2006-08-10

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

******************** Netragard, L.L.C Advisory* *******************

Strategic Reconnaissance Team

------------------------------------------------
http://www.netragard.com -- "We make I.T. Safe."


[Advisory Information]
- ----------------------------------------------------------------------
Advisory ID : NETRAGARD-20060810
Advisory Contact : Adriel T. Desautels
Credit : Undisclosed
Product Name : libpthread
Product Version : 5.1b
Vendor Name : Hewlet Packard
Type of Vulnerability : Local Root Compromise
Effort : Very Difficult
Operating System : Tru64
Other : Buffer Overflow

[Product Description]
- ----------------------------------------------------------------------
The pthread library (libpthread) provides interfaces for developing
multi-threaded applications.

[Technical Summary]
- ----------------------------------------------------------------------
libpthread suffers from a buffer overflow vulnerability which may
enable an attacker to execute arbitrary commands on the system. This
vulnerability may potentially be exploited by a creating a specially
crafted buffer and inserting it into the PTHREAD_CONFIG variable.

[Technical Details]
- ----------------------------------------------------------------------
libpthread reads in the PTHREAD_CONFIG environment variable. It may be
possible to exploit libpthread on HP's tru64 by creating a specially
crafted buffer. The details below do not contain the specially crafted
buffer. Exploitation of this specific vulnerability is very difficult.

##################################################################
#
# Insert 273 A's (41) into the PTHREAD_CONFIG variable
#
##################################################################

OSF1 tru64 V5.1 2650 alpha
bash-3.00# export PTHREAD_CONFIG=`perl -e 'print "A"x 273'`
bash-3.00# newaliases
Segmentation fault (core dumped)

##################################################################
#
# Insert 274 A's (41) into the PTHREAD_CONFIG variable
#
##################################################################

bash-3.00# export PTHREAD_CONFIG=`perl -e 'print "A"x 274'`
bash-3.00# newaliases
Unaligned access pid=15750 <newaliases> va=0x11fff00a4 pc=0x3ff805c8bf8
ra=0x3ff805c8bf8 inst=0xa4290040
Unaligned access pid=15750 <newaliases> va=0x11fff00bc pc=0x3ff805c8bfc
ra=0x3ff805c8bf8 inst=0xa4490058
Unaligned access pid=15750 <newaliases> va=0x11fff008c pc=0x3ff805c8c48
ra=0x3ff805c8bf8 inst=0xa5090028

##################################################################
#
# Run newaliases in gdb with the -q flag.
#
##################################################################

bash-3.00# gdb /tmp/newaliases -q
(no debugging symbols found)...(gdb) r
Starting program: /tmp/newaliases
(no debugging symbols found)...(no debugging symbols found)...(no
debugging symbols found)...
(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
0x3ff805c8bf8 in __putString () from /usr/shlib/libpthread.so

##################################################################
#
# Execute a back trace (bt) within gdb
#
##################################################################

(gdb) bt
#0 0x3ff805c8bf8 in __putString () from /usr/shlib/libpthread.so
#1 0x3ff805c8a78 in __putFormatEol () from /usr/shlib/libpthread.so
#2 0x3ff805bc4f8 in __utlOptManage () from /usr/shlib/libpthread.so
warning: Hit heuristic-fence-post without finding
warning: enclosing function for address 0x4141414141414141
This warning occurs if you are debugging a function without any symbols
(for example, in a stripped executable). In that case, you may wish to
increase the size of the search with the `set heuristic-fence-post'
command.

Otherwise, you told GDB there was a function where there isn't one, or
(more likely) you have encountered a bug in GDB.

#
# Execute Info Registers within gdb
#

(gdb) i r
v0 0x226 550
t0 0x11fff9b3e 4831812414
t1 0x0 0
t2 0x2 2
t3 0x0 0
t4 0x3ffc0081a00 4396973300224
t5 0x40 64
t6 0x7fffffe6 2147483622
t7 0x19 25
s0 0x4141414141414141 4702111234474983745
s1 0x11fff9c90 4831812752
s2 0x11fff9c88 4831812744
s3 0x0 0
s4 0x0 0
s5 0x11fff9ad8 4831812312
fp 0x1 1
a0 0xbf 191
a1 0x11fff9918 4831811864
a2 0x11fff96b0 4831811248
a3 0x11fff9b34 4831812404
a4 0x0 0
a5 0x11fff9b30 4831812400
t8 0x11fff9931 4831811889
t9 0x62 98
t10 0x49 73
t11 0x1 1
ra 0x3ff805c8bf8 4395905092600
t12 0x3ff801c1380 4395900867456
at 0x41416469 1094804585
gp 0x3ffc01c0170 4396974604656
sp 0x11fff98b0 4831811760
zero 0x0 0
fpcr 0x0 0
pc 0x3ff805c8bf8 4395905092600
vfp 0x11fff9900 4831811840

frame 2
v0 0x226 550
t0 0x11fff9b3e 4831812414
t1 0x0 0
t2 0x2 2
t3 0x0 0
t4 0x3ffc0081a00 4396973300224
t5 0x11fff9a50 4831812176
t6 0x7fffffe6 2147483622
t7 0x19 25
s0 0x1 1
s1 0x11fff9c90 4831812752
s2 0x11fff9c88 4831812744
s3 0x0 0
s4 0x0 0
s5 0x11fff9ad8 4831812312
fp 0x1 1

##################################################################
#
# The following registers, a0, a1, a2, a3, a4, a5, have been
# overwritten with A's (0x41).
#
##################################################################

a0 0x4141414141414141 4702111234474983745
a1 0x4141414141414141 4702111234474983745
a2 0x4141414141414141 4702111234474983745
a3 0x4141414141414141 4702111234474983745
a4 0x4141414141414141 4702111234474983745
a5 0x4141414141414141 4702111234474983745
t8 0x11fff9931 4831811889
t9 0x62 98
t10 0x49 73
t11 0x1 1
ra 0x3ff805bc4f8 4395905041656
t12 0x3ff801c1380 4395900867456
at 0x41416469 1094804585
gp 0x3ffc01c0170 4396974604656
sp 0x11fff9a80 4831812224
zero 0x0 0
fpcr 0x0 0
pc 0x3ff805bc4f8 4395905041656

##################################################################
#
# Other binaries which are linked agianst libpthread.so
# will also segfault when the PTHREAD_CONFIG variable
# is set to a large string of A's. The following is
# a list of some of those binaries
#
##################################################################

/usr/sbin/mailq
/usr/sbin/sendmail
/usr/sbin/sendmail.v8.11.1
/usr/sbin/smtpd
/usr/sbin/collect
/usr/dt/bin/mailcv

##################################################################
#
# Sendmail Example. Loading sendmail core file with
# the tru64 debugger.
#
##################################################################

bash-3.00# dbx ./sendmail core
dbx version 5.1
Type 'help' for help.
Core file created by program "sendmail"

warning: ./sendmail has no symbol table -- very little is
supported without it

signal Segmentation fault at >*[__putString, 0x3ff805c8bf8] ldq
t0, 64(s0)
(dbx) where
> 0 __putString(0x0, 0x0, 0x11fffbad8, 0x1, 0x11fffb918)
[0x3ff805c8bf8]
1 __putFormatEol(0x4141414141414141, 0x4141414141414141,
0x4141414141414141, 0x4141414141414141, 0x4141414141414141)
[0x3ff805c8a74]
2 __utlOptManage(0x30002800000, 0x26000, 0x3ff805c09c4,
0x3ffc01b8098, 0x3ff805c0a14) [0x3ff805bc4f4]

##################################################################
#
# Older versions are also vulnerable...
#
##################################################################

Older versions are also vulnerable...
tru64.netragard> uname -a
OSF1 tru64.netragard V5.0 910 alpha
tru64.netragard> PTHREAD_CONFIG=`perl -e 'print "A"x 272'`
tru64.netragard> export PTHREAD_CONFIG
tru64.netragard> /usr/dt/bin/mailcv

%PTHREAD_CONFIG keyword
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAA"

is not valid
Memory fault

Other binareis on 5.0
/usr/bin/ladebug

[Proof of Concept]
- ----------------------------------------------------------------------
Undislcosed

[Vendor Status]
- ----------------------------------------------------------------------
Vendor contacted patch released.


[About Netragard]
- ----------------------------------------------------------------------
Netragard offers specialized application, network security, and
managed security services which enable its clients to take a proactive
security stance. Each of our services is driven by security
professionals who specialize in specific areas of Information
Security. This specialized focus differentiates Netragard from the
competition by enabling Netragard to produce deliverables which are
the product of skilled security professionals and not the product of
automated tools and scripts.

[ For more information please visit http://www.netragard.com ]

[Disclaimer]
- ---------------------http://www.netragard.com-------------------------
Netragard, L.L.C. assumes no liability for the use of the information
provided in this advisory. This advisory was released in an effort to
help the I.T. community protect themselves against a potentially
dangerous security hole. This advisory is not an attempt to solicit
business.

<a href="http://www.netragard.com">http://www.netragard.com</a>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iD8DBQFFU/c7Qwbn1P9Iaa0RAs+GAJ494WKCsHlPEFjsL1Zy+hQtpsGVRQCfSdUL
eUqI/l8ML/I2/rKIDHvZ/k8=
=h9zy
-----END PGP SIGNATURE-----

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close