[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Buffer overflow/privilege escalation in MacOS X


On Dec 15, 2003, at 2:54 PM, Max wrote:

Hi,

It appears that parts of MacOSX that didn't come from BSD are
not very well written and have significant security issues.

An example is a /System/Library/Filesystems/cd9660.fs/cd9660.util
utility. It is suid root and it is vulnerable to a classic buffer
overflow due to the lack of input validation.

[snip]

sdsx:/System/Library/Filesystems/cd9660.fs root# gdb -core /cores/core.1405 ./cd9660.util
[gdb banner here]
Reading symbols for shared libraries .... done
Core was generated by `./cd9660.util'.
#0 0x9000d360 in strcat ()
(gdb) where
#0 0x9000d360 in strcat ()
#1 0x00002b84 in main ()
#2 0x41414141 in ?? ()

Unfortunately, I don't think this is exploitable. main() would have to blr instead of making a system call to exit() for this to be exploitable. Additionally, no other calls seem to call any exploitable functions like strcat or strcpy. This would probably be exploitable if the function calling it wasn't main().

For what it's worth, the segfault comes from a bad access when strcat tries to read from 0x41414141 because its source vector gets overwritten by an earlier strcat (the destination vectors are stored earlier in memory and can't be overwritten, not that you'd be likely to be able to do anything with the overwritten vectors since there don't seem to be any places you can overwrite the stored link register value - main sticks it in a register, doesn't touch it, and in fact doesn't even use the saved value for returning, since it calls exit()).