Good day. Fri, Feb 29, 2008 at 04:39:03PM -0000, sipherr@gmail.com wrote:> I just tested this on FreeBSD 6.3. This bug was discovered on NetBSD. It also works on OpenBSD (unconfirmed on 4.2) > > Steps to reproduce: > > 1. Run ppp > > 2. type the following (or atleat some variation of) > > ~/~/~/~/~/~/~/~/~/~/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx > > > > This will produce a segmentation violation (Core dumped).Yes, good catch: looks like stack-based buffer overflow. Also works on FreeBSD 7.0. Could you please test the following rough patch -- it seem to cure the situation. Although it is a bit late for today and I will recheck it more carefully tomorrow. diff --git a/usr.sbin/ppp/systems.c b/usr.sbin/ppp/systems.c index 77f06a1..0cf01d1 100644 --- a/usr.sbin/ppp/systems.c +++ b/usr.sbin/ppp/systems.c @@ -82,6 +82,10 @@ InterpretArg(const char *from, char *to) from++; while (*from != '\0') { + if (to >= endto) { + *endto = '\0'; + return from; + } switch (*from) { case '"': instring = !instring; @@ -97,6 +101,10 @@ InterpretArg(const char *from, char *to) *to++ = '\\'; /* Pass the escapes on, maybe skipping \# */ break; } + if (to >= endto) { + *endto = '\0'; + return from; + } *to++ = *from++; break; case '$': @@ -127,6 +135,10 @@ InterpretArg(const char *from, char *to) *ptr++ = *from; *ptr = '\0'; } + if (to >= endto) { + *endto = '\0'; + return from; + } if (*to == '\0') *to++ = '$'; else if ((env = getenv(to)) != NULL) { @@ -142,6 +154,10 @@ InterpretArg(const char *from, char *to) if (len == 0) pwd = getpwuid(ID0realuid()); else { + if (to + len >= endto) { + *to = '\0'; + return from; + } strncpy(to, from, len); to[len] = '\0'; pwd = getpwnam(to); Thank you! -- Eygene
Eygene Ryabinkin napsal/wrote, On 03/02/08 00:06:>> 1. Run ppp >> 2. type the following (or atleat some variation of)...> Yes, good catch: looks like stack-based buffer overflow> Could you please test the following rough patchIt seems you are going to cut of part of line silently. IMHO - the line shall be rejected as invalid at all or warning needs to be issued at least ... Someone may create so long line (unintentionally), it will not work for him with no hint why - it's not so polite ... Dan
Me again. Sun, Mar 02, 2008 at 02:06:34AM +0300, Eygene Ryabinkin wrote:> Fri, Feb 29, 2008 at 04:39:03PM -0000, sipherr@gmail.com wrote: > > I just tested this on FreeBSD 6.3. This bug was discovered on NetBSD. It also works on OpenBSD (unconfirmed on 4.2) > > > > Steps to reproduce: > > > > 1. Run ppp > > > > 2. type the following (or atleat some variation of) > > > > ~/~/~/~/~/~/~/~/~/~/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx > > > > > > > > This will produce a segmentation violation (Core dumped). > > Yes, good catch: looks like stack-based buffer overflow. Also works > on FreeBSD 7.0. Could you please test the following rough patch -- > it seem to cure the situation. Although it is a bit late for > today and I will recheck it more carefully tomorrow.About the possible exploitation scenarios: I see two of them in the default FreeBSD installation, when ppp is setuid root and permitted to run only for root and the 'network' group. a) Trusted users from the group 'network': interactive privilege escalation and local root exploit. b) Trusted users who can modify ppp's configuration files: non-interactive escalation and local root exploit (remote root exploit in the setups where some Web interface to the PPP configuration and like exists). Had I missed something? -- Eygene