CDRTools CDRecord Devname Format String Vulnerability
BID:7565
Info
CDRTools CDRecord Devname Format String Vulnerability
| Bugtraq ID: | 7565 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0289 |
| Remote: | No |
| Local: | Yes |
| Published: | May 13 2003 12:00AM |
| Updated: | Jul 11 2009 10:06PM |
| Credit: | Discovery of this vulnerability has been credited to Stefano Di Paola <[email protected]>. |
| Vulnerable: |
CDRTools CDRecord 2.0 CDRTools CDRecord 1.11 |
| Not Vulnerable: | |
Discussion
CDRTools CDRecord Devname Format String Vulnerability
CDRecord has been reported prone to a format string vulnerability. The issue presents itself due to a programming error that occurs when calling a printf-like function.
It has been reported that by harnessing an unsupported feature of the CDRecord utility, an attacker may supply format string specifiers as the 'dev' argument passed to the vulnerable utility.
This may ultimately result in the execution of attacker-supplied code in the context of the CDRecord utility. It has been reported that CDRecord is installed setUID root on several distributions.
It should be noted that although this vulnerability has been reported to affect CDRecord version 2.0 previous versions might also be affected.
CDRecord has been reported prone to a format string vulnerability. The issue presents itself due to a programming error that occurs when calling a printf-like function.
It has been reported that by harnessing an unsupported feature of the CDRecord utility, an attacker may supply format string specifiers as the 'dev' argument passed to the vulnerable utility.
This may ultimately result in the execution of attacker-supplied code in the context of the CDRecord utility. It has been reported that CDRecord is installed setUID root on several distributions.
It should be noted that although this vulnerability has been reported to affect CDRecord version 2.0 previous versions might also be affected.
Exploit / POC
CDRTools CDRecord Devname Format String Vulnerability
The following proof of concept was supplied, additional exploit 'priv8cdr.pl' supplied by Priv8security.com:
$ ./cdrecord dev="AAAA|%x%x%x%x%x%x%x%x%x%x%x" int.c
The following proof of concept was supplied, additional exploit 'priv8cdr.pl' supplied by Priv8security.com:
$ ./cdrecord dev="AAAA|%x%x%x%x%x%x%x%x%x%x%x" int.c
Solution / Fix
CDRTools CDRecord Devname Format String Vulnerability
Solution:
Mandrake has released a security advisory (MDKSA-2003:058-1), updating a previous advisory. Users are advised to upgrade as soon as possible. Further information regarding how to obtain and apply fixes can be found in the attached advisory.
The vendor has released an update to address this issue:
CDRTools CDRecord 2.0
Solution:
Mandrake has released a security advisory (MDKSA-2003:058-1), updating a previous advisory. Users are advised to upgrade as soon as possible. Further information regarding how to obtain and apply fixes can be found in the attached advisory.
The vendor has released an update to address this issue:
CDRTools CDRecord 2.0
-
CDRTools cdrtools-2.01a14.tar.gz
ftp://ftp.berlios.de/pub/cdrecord/alpha/cdrtools-2.01a14.tar.gz
References
CDRTools CDRecord Devname Format String Vulnerability
References:
References:
- CDRTools Homepage (CDRTools)
- cdrtools2.0 Format String Vulnerability (Stefano Di Paola