BID:8305

Sun Solaris Runtime Linker LD_PRELOAD Local Buffer Overflow Vulnerability

Info

Sun Solaris Runtime Linker LD_PRELOAD Local Buffer Overflow Vulnerability

Bugtraq ID:	8305
Class:	Boundary Condition Error
CVE:	CVE-2003-0609
Remote:	No
Local:	Yes
Published:	Jul 29 2003 12:00AM
Updated:	Jul 11 2009 10:56PM
Credit:	Discovery of this vulnerability has been credited to Jouko Pynnonen <[email protected]>.
Vulnerable:	Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6

Not Vulnerable:

Discussion

Sun Solaris Runtime Linker LD_PRELOAD Local Buffer Overflow Vulnerability

The Sun Solaris ld runtime linker has been reported prone to a buffer overflow vulnerability. It has been conjectured that the issue presents itself, due to insufficient bounds checking performed in the routines used to process the value of LD_PRELOAD. A local attacker may exploit this issue to execute arbitrary code with elevated privileges.

Exploit / POC

Sun Solaris Runtime Linker LD_PRELOAD Local Buffer Overflow Vulnerability

CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following proof of concept has been supplied:

$ LD_PRELOAD=/`perl -e 'print "A"x2000'`/ passwd
ld.so.1: passwd: warning /AAAAAAA ... AAAAA/: open failed: illegal
insecure pathname
Segmentation Fault (core dumped)

Two exploits have also been released.

/data/vulnerabilities/exploits/10.27.ldso1_SPARC_ex.c
/data/vulnerabilities/exploits/raptor_ldpreload.c

Solution / Fix

Sun Solaris Runtime Linker LD_PRELOAD Local Buffer Overflow Vulnerability

Solution:
The vendor has released patches to address this issue:

Sun Solaris 2.6