OpenBSD IBCS2 Binary Length Parameter Kernel-Based Buffer Overrun Vulnerability
BID:9061
Info
OpenBSD IBCS2 Binary Length Parameter Kernel-Based Buffer Overrun Vulnerability
| Bugtraq ID: | 9061 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2003-0955 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 17 2003 12:00AM |
| Updated: | Jul 12 2009 12:56AM |
| Credit: | This vulnerability was discovered by Georgi Guninski. This vulnerability was also independently discovered by noir. |
| Vulnerable: |
OpenBSD OpenBSD 2.9 OpenBSD OpenBSD 2.8 OpenBSD OpenBSD 2.7 OpenBSD OpenBSD 2.6 OpenBSD OpenBSD 2.5 OpenBSD OpenBSD 2.4 OpenBSD OpenBSD 2.3 OpenBSD OpenBSD 2.2 OpenBSD OpenBSD 2.1 OpenBSD OpenBSD 2.0 OpenBSD OpenBSD 3.4 OpenBSD OpenBSD 3.3 OpenBSD OpenBSD 3.2 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0 |
| Not Vulnerable: | |
Discussion
OpenBSD IBCS2 Binary Length Parameter Kernel-Based Buffer Overrun Vulnerability
A buffer overrun has been discovered within the OpenBSD kernel when handling malformed COFF executables. The problem occurs when the kernel is carrying out a read operation on the binary file, incorrectly using the length parameter within the COFF header structure without first carryout out sanity checking. As a result, a malformed binary may be capable of triggering a stack overrun within the context of kernel memory. This vulnerability could potentially be exploited to gain elevated privileges on OpenBSD 2.x-3.3 systems. It has yet to be confirmed whether this is also possible on OpenBSD 3.4, however it is said to be possible to at least trigger a kernel panic.
A buffer overrun has been discovered within the OpenBSD kernel when handling malformed COFF executables. The problem occurs when the kernel is carrying out a read operation on the binary file, incorrectly using the length parameter within the COFF header structure without first carryout out sanity checking. As a result, a malformed binary may be capable of triggering a stack overrun within the context of kernel memory. This vulnerability could potentially be exploited to gain elevated privileges on OpenBSD 2.x-3.3 systems. It has yet to be confirmed whether this is also possible on OpenBSD 3.4, however it is said to be possible to at least trigger a kernel panic.
Exploit / POC
OpenBSD IBCS2 Binary Length Parameter Kernel-Based Buffer Overrun Vulnerability
The following exploit was provided by noir:
The following exploit was provided by noir:
Solution / Fix
OpenBSD IBCS2 Binary Length Parameter Kernel-Based Buffer Overrun Vulnerability
Solution:
The vendor has addressed this issue via CVS. The patched source file can be obtained through the following link:
http://www.openbsd.org/cgi-bin/cvsweb/src/sys/compat/ibcs2/ibcs2_exec.c.diff?r1=1.14.6.1&r2=1.14.6.2
Patches have also been made available.
OpenBSD OpenBSD 3.3
OpenBSD OpenBSD 3.4
Solution:
The vendor has addressed this issue via CVS. The patched source file can be obtained through the following link:
http://www.openbsd.org/cgi-bin/cvsweb/src/sys/compat/ibcs2/ibcs2_exec.c.diff?r1=1.14.6.1&r2=1.14.6.2
Patches have also been made available.
OpenBSD OpenBSD 3.3
-
OpenBSD 011_ibcs2.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/i386/011_ibcs2.patch
OpenBSD OpenBSD 3.4
-
OpenBSD 006_ibcs2.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/i386/006_ibcs2.patch
References
OpenBSD IBCS2 Binary Length Parameter Kernel-Based Buffer Overrun Vulnerability
References:
References:
- OpenBSD Homepage (OpenBSD)
- OpenBSD kernel holes ... ([email protected] )