Mkdir Buffer Overflow Vulnerability

Bugtraq ID:	10462
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 02 2004 12:00AM
Updated:	Jun 02 2004 12:00AM
Credit:	Credit for this vulnerability goes to Tim Newsham <[email protected]>.
Vulnerable:	Bell Labs Unix Seventh Edition
Not Vulnerable:

Mkdir Buffer Overflow Vulnerability

It is reported that mkdir is susceptible to a buffer overflow vulnerability. An attacker with local access passes a long path to mkdir, which overflows a fixed buffer.

Mkdir is installed setuid root by default, as the mknod() system call can only be called by root. There is no mkdir() system call, so the mkdir command must use mknod to create a directory node, then populate the node with "." and ".." itself.

A local attacker can exploit this issue to execute arbitrary code as root.

Mkdir Buffer Overflow Vulnerability

Tim Newsham <[email protected]> has provided an exploit for this issue.

• /data/vulnerabilities/exploits/unix-v7-mkdir.c

Mkdir Buffer Overflow Vulnerability

Solution:
Tim Newsham suggests adding:

if(strlen(d) >= 126) {
fprintf(stderr, "mkdir: path is too long\n");
++Errors;
return;
}

to the start of the mkdir() function in /usr/src/cmd/mkdir.c

This has not been tested.

Mkdir Buffer Overflow Vulnerability

References:

• The Online Software Museum - UNIX V7 (The Online Software Museum)
  
• Mkdir buffer overflow vulnerability in Unix Seventh Edition. (Tim Newsham )