OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 3rd quarter (Jul-Sep) 1997: Re: Solaris ld.so possibly vulnerable?

Re: Solaris ld.so possibly vulnerable?

Casper Dik (casperHOLLAND.SUN.COM)
Tue, 22 Jul 1997 11:47:28 +0200 

>As for the existance of a stack overrun condition similar to the one
>in Linux in the Solaris ld.so, I do not believe this to be the case.
>
>The bug the program you posted triggers is indeed becasue of a call to
>strcpy(), however the buffers in question are not on the stack but are
>malloc()ed during run time.  (There are some cases where ld.so first calls
>strlen() to determine how much memory to ask malloc() for, if I remember
>correctly; obviously, the particular instance you've discovered is not one
>of those).


The bug is in a routine that formats error messages into a dynamically allocated
buffer.

SInce the buffer will live after the program's data segment, the _iob
(stdioflow) trick won't work on it.

Also, when applied to a set-uid/set-gid program it isn't possible to
force an ld.so error using LD_PRELOAD (ignored) or many of the
other LD_ variables; they're mostly ignored)

However, in some versions of Solaris such errors are generated by the
implementation of dynamically loadable functionality and on such systems
you can crash set-uid executables.


Casper