This fixes a potentially exploitable buffer overrun in dtprintinfo.
This was brought to my attention based on a 0day exploit released for
Solaris CDE.
The exploit code does not work (or build) on linux, and the overrun is
in the heap rather than the stack as on Solaris, but it's easy to see
how this could be exploited.
The following is the content of the advisory:
8<-----------------------------------------------------------
@Mediaservice.net (Cybaze Group) Security Advisory #2019-01 (2019-05-07)
Title: Local privilege escalation via CDE dtprintinfo
Application: Common Desktop Environment 2.3.0 and earlier
Platforms: Oracle Solaris 10 1/13 (Update 11) and earlier
Description: A local attacker can gain root privileges by exploiting
a buffer overflow in CDE dtprintinfo
Author: Marco Ivaldi <marco.ivaldi@mediaservice.net>
Contributor: Dave Aitel <dave.aitel@cyxtera.com> (original discovery)
Vendor Status: <secalert_us@oracle.com> notified on 2019-05-05
<cdesktopenv-devel@lists.sourceforge.net> notified on 2019-05-05
CVE: The Common Vulnerabilities and Exposures project has not assigned
a name to this issue yet
References: https://lab.mediaservice.net/advisory/2019-01-cde-dtprintinfo.txthttps://github.com/0xdea/raptor_infiltrate19https://sourceforge.net/p/cdesktopenv/wiki/Home/https://www.oracle.com/technetwork/server-storage/solaris10/https://www.mediaservice.net/https://infiltratecon.com/
1. Abstract.
A buffer overflow in the DtPrinterAction::PrintActionExists() function in the
Common Desktop Environment 2.3.0 and earlier, as used in Oracle Solaris 10 1/13
(Update 11) and earlier, allows local users to gain root privileges via a long
printer name passed to dtprintinfo by a malicious lpstat program.
This is a 0day vulnerability demonstrated at #INFILTRATE19 on May 2nd, 2019 in
the talk "A bug's life: story of a Solaris 0day".
2. Example Attack Session.
bash-3.2$ cat /etc/release
Oracle Solaris 10 1/13 s10x_u11wos_24a X86
Copyright (c) 1983, 2013, Oracle and/or its affiliates. All rights reserved.
Assembled 17 January 2013
bash-3.2$ uname -a
SunOS nostalgia 5.10 Generic_147148-26 i86pc i386 i86pc
bash-3.2$ id
uid=54322(raptor) gid=1(other)
bash-3.2$ gcc raptor_dtprintname_intel.c -o raptor_dtprintname_intel -Wall
bash-3.2$ ./raptor_dtprintname_intel 192.168.1.1:0
raptor_dtprintname_intel.c - dtprintinfo 0day, Solaris/Intel
Copyright (c) 2004-2019 Marco Ivaldi <raptor@0xdeadbeef.info>
Using SI_PLATFORM : i86pc (5.10)
Using stack base : 0x8047fff
Using rwx_mem address : 0xfeffa004
Using sc address : 0x8047f60
Using strcpy() address : 0xfefe26a0
lpstat called with -v
lpstat called with -v
lpstat called with -d
uid=0(root) gid=1(other)
3. Affected Platforms.
All platforms shipping the Common Desktop Environment are potentially
affected. This includes:
* Oracle Solaris 10 1/13 (Update 11) and earlier [default installation]
According to the CDE Wiki, the following platforms are officially supported:
* All Official Ubuntu variants 12.04 - 18.04
* Debian 6, 7, 8, 9
* Fedora 17 at least
* Archlinux
* Red Hat
* Slackware 14.0
* OpenBSD
* NetBSD
* FreeBSD 9.2, 10.x, 11.x
* openSUSE Tumbleweed (gcc7)
* openSUSE Leap 4.2 (gcc4)
* SUSE 12 SP3 (gcc4)
* Solaris, OpenIndiana
4. Fix.
The upstream CDE maintainers have issued a patch for this vulnerability. Oracle
is investigating the issue via tracking# S1153109 and is expected to release a
fix for all affected-supported versions of Solaris via their quarterly Critical
Patch Update (CPU) program.
As a temporary workaround, it is possible to remove the setuid bit from the
dtprintinfo executable as follows:
bash-3.2# chmod -s /usr/dt/bin/dtprintinfo
5. Proof of Concept.
A working exploit for Oracle Solaris 10 1/13 (Update 11) Intel has been
developed as a proof of concept. Exploits for other Solaris versions and for
the SPARC architecture are also available. All exploits can be downloaded at:
https://github.com/0xdea/raptor_infiltrate19/https://github.com/0xdea/exploits/
8<-----------------------------------------------------------
When using a non C locale such as fr_FR.ISO8859-1, the CUPS messages
returned by lpq are translated. However, the parser in ParseJobs.C can only
handle messages in English. As a result, dtprintinfo exits immediately with
an error message. To fix that problem we force a LANG=C environment when calling
lpq so that messages will be in English and will be processed correctly by dtprintinfo
parser.
XtArgVal should be a type that encompasses XtPointer
and long integer types. In the X.org implementation
it is currently defined as (long).
Don't use (unsigned int *) instead of (Window *).
Use /usr/local/bin/lpq from CUPS for FreeBSD
for now; this prevents immediate dtprintinfo
crash.
In the future we should handle both built-in
/usr/bin/lpq as well as CUPS /usr/local/bin/lpq
output in separate functions.
Code to support CUPS should probably shared between
other operating systems.
This patch removes instances of hardcoded
invocation of /bin/ksh and allows to
replace it with, for, example,
/usr/local/bin/ksh93
Also "ksh93" is accepted whenever "ksh" is.
Tested using the following /bin/ksh:
----8<----
WHAT=`ps -o command= -p $PPID`
msg="Something tried to call /bin/ksh: $PPID: $WHAT"
print -u2 "$msg"
logger user.warn "$msg"
exit 99
----8<----
(Warning: first two lines are FreeBSD specific)
Scripts from Makefiles should now be executed either
with
$(KORNSHELL) korn-shell-script
or
$(SHELL) bourne-shell-script
therefore #!/bin/ksh has not been changed everywhere.
/usr/dt/bin/ scripts have been converted (e.g. Xsession)
Whenever possible Imake and CPP facilities have been used.
For C and C++ programs KORNSHELL needs to be defined to
"/path/to/your/ksh" (with quotes) so that it can make
a valid C constant.
Therefore, when adding KORNSHELL to Imakefile for C files,
you have to add
CXXEXTRA_DEFINES = -DKORNSHELL=\"$(KORNSHELL)\"
or similar (for example, see programs/dtprintinfo)
But for simple shell script substitution we usually change
LOCAL_CPP_DEFINES = -DCDE_CONFIGURATION_TOP=$(CDE_CONFIGURATION_TOP) \
-DCDE_INSTALLATION_TOP=$(CDE_INSTALLATION_TOP) \
-DCDE_LOGFILES_TOP=$(CDE_LOGFILES_TOP)
to:
LOCAL_CPP_DEFINES = -DCDE_CONFIGURATION_TOP=$(CDE_CONFIGURATION_TOP) \
-DCDE_INSTALLATION_TOP=$(CDE_INSTALLATION_TOP) \
-DCDE_LOGFILES_TOP=$(CDE_LOGFILES_TOP) \
-DKORNSHELL=$(KORNSHELL) \
-DXPROJECTROOT=X11ProjectRoot
since we don't want quotes for shell scripts.
Add preprocessor directives not to try
to redefine sys_errlist[] or sys_nerr
There are already definitions:
extern __const char *__const sys_errlist[];
extern __const int sys_nerr;
in <stdio.h>
Actually we should have something like
NeedSysErrlist in imake definitions
to get rid of those #ifdefs.
Introduce KORNSHELL make variable to point
to the implementation of the Korn Shell.
Use $(SHELL) or $(KORNSHELL) explicitly for
make programs that do not automatically call
shell scripts from the current directory.
Chase