-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[ Sun Solaris 10 filesystem rm(1),find(1),etc, Denial-of-service ]
Author: Maksymilian Arciemowicz
SecurityReason.com
Date:
Affected Software:
Original URL:
http://securityreason.com/achievement_securityalert/85
Sun Microsystems, Inc. is a wholly owned subsidiary of Oracle Corporation, selling
computers, computer components, computer software, and information technology services.
Sun was founded on February 24, 1982. The company was headquartered in Santa Clara,
California (part of Silicon Valley), on the former west campus of the Agnews
Developmental Center.
In computing, ZFS is a combined file system and logical volume manager designed by Sun
Microsystems. The features of ZFS include support for high storage capacities,
integration of the concepts of filesystem and volume management, snapshots and
copy-on-write clones, continuous integrity checking and automatic repair, RAID-Z and
native NFSv4 ACLs.
PoC:
we need use 1…8000 or bigger value to make stack overflow.
in result
Segmentation fault (core dumped)
(no debugging symbols found)
(gdb) r X
Starting program: /usr/bin/du X
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
Program received signal SIGSEGV, Segmentation fault.
0xfeedfc8a in _ndoprnt () from /lib/libc.so.1
(gdb) x/i $eip
0xfeedfc8a <_ndoprnt+12>: push %ebp
We can simple remove this dir for 1…8000
but let`s try create this
Segmentation fault (core dumped)
rm(1) has fail!
what is wrong? stack overflow
(no debugging symbols found)
(gdb) r -rf Y
Starting program: /usr/bin/rm -rf Y
(no debugging symbols found)
(no debugging symbols found)
Program received signal SIGSEGV, Segmentation fault.
0x08051c03 in ?? ()
(gdb) x/i $eip
0x8051c03: push %ebx
Segmentation fault (core dumped)
find(1) also fails!
(no debugging symbols found)
(gdb) r Y CX >> /dev/null
Starting program: /usr/bin/find Y CX >> /dev/null
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
Program received signal SIGSEGV, Segmentation fault.
0xfeecfc8a in _ndoprnt () from /lib/libc.so.1
(gdb) x/i $eip
0xfeecfc8a <_ndoprnt+12>: push %ebp
— 2. Fix —
Sun Solaris will fix this issue.
— 3. Greets —
sp3x Infospec pi3
— 4. Contact —
Author: SecurityReason.com [ Maksymilian Arciemowicz ]
Email:
GPG:
http://securityreason.com/
http://securityreason.com/exploit_alert/ - Exploit Database
http://securityreason.com/security_alert/ - Vulnerability Database
-----BEGIN PGP SIGNATURE-----
iEYEARECAAYFAkv2dbQACgkQpiCeOKaYa9aN0QCgvsk4mNEx7yXRqAX/CHOZl53x
J2YAn1OnO769x8IN2evc3VMt79QTOp+O
=2r72
-----END PGP SIGNATURE-----