Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mac OS X Buffer Overflow Found

Posted by ryuzaki0 on from the and-so-it-begins dept.

MacDork writes "Well, if default settings in Mac OS X made Lance Ulanoff excited, this is really going to make him do the monkey boy dance... SecurityFocus's Bugtraq mailing list just posted a buffer overflow, in the utility for mounting and probing ISO 9660 file systems. No exploits were mentioned. No word on whether 'Max' alerted Apple or anyone outside of the Bugtraq mailing list though." Also, 'Max' made entirely unfounded, sweeping statements about the general quality of Mac OS X from this one little item, but oh well. When you're on top, you make a tempting target.

20 of 161 comments (clear)

  1. Looks low risk to me... by MarkusQ · · Score: 5, Interesting

    From looking at the posting, I don't see any demonstration (or even any indication) that this is exploitable. What I see is that, if you put a goobered up CDROM in the drive (or use perl to simulate same)...

    ...it won't work.

    Yes, it might be possible to craft some clever exploit in the usual way, but that is by no means easy and is often impossible (depending mostly on what gets allocated around the buffer).

    And if it is exploitable? Will we see a rash of strangers in London Fog coats trying to slip CDs into unsuspecting Macs? We already prevent that, since anyone who could do that could do anything they wanted anyway, up to and including installing an old copy of BeOS over OSX anyway.

    -- MarkusQ

    1. Re:Looks low risk to me... by Anonymous Coward · · Score: 3, Interesting

      [Jonathan-Dobbies-Computer:/Users/jsdobbie] guest% /System/Library/Filesystems/cd9660.fs max$ ls -la cd9660.util
      su: /System/Library/Filesystems/cd9660.fs: Permission denied.

      makes me question it's usefulness even more

      If one has physical access to the machine, it isn't secure; everyone knows this

    2. Re:Looks low risk to me... by ag0ny · · Score: 5, Interesting

      And if it is exploitable? Will we see a rash of strangers in London Fog coats trying to slip CDs into unsuspecting Macs? We already prevent that, since anyone who could do that could do anything they wanted anyway, up to and including installing an old copy of BeOS over OSX anyway.

      That's not the way it works. The problem is a typical input validation problem in a setuid root binary. You don't need a CD. In fact, you don't even need physical access to the computer.

      This is a privilege scalation vulnerability. If exploitable, this means that someone with non-superuser access to the computer could exploit the (as of yet unconfirmed) vulnerabilty in this binary to gain superuser privileges.

      You must take into account that you don't need to be a local user in order to run this program. Some other vulnerability or misconfiguration can be used first in order to run an exploit against the cd9660.util binary.

      --
      My site
    3. Re:Looks low risk to me... by Anonymous Coward · · Score: 1, Interesting

      -- And if it is exploitable? Will we see a rash of strangers in London Fog coats trying to slip CDs into unsuspecting Macs? We already prevent that, since anyone who could do that could do anything they wanted anyway, up to and including installing an old copy of BeOS over OSX anyway. --

      There is an open firmware password utility for all firmware Macs (I.e. post-Beige, Jobs era) that will require a password to boot from a CD or anything other than the primary boot drive.

      Most Mac towers have a locakble cases also in case you are extra paranoid. ;)

    4. Re:Looks low risk to me... by klui · · Score: 3, Interesting

      Maybe you're running Jaguar or some other version of OS X. Panther 10.3.1 has the directory world readable and I was able to reproduce the seg fault.

    5. Re:Looks low risk to me... by You're+All+Wrong · · Score: 5, Interesting

      "I don't see any demonstration (or even any indication) that this is exploitable."

      Then what the fuck is "#2 0x41414141 in ?? ()"?

      To me, that looks like user data in the stack frame.
      To me, that means that an arbitrary jump can be executed.
      To me, that means that arbitrary NUL-less code can be executed.

      And the chances of there existing NUL-less BSD PPC shell-code are what, you ask?

      Here's your answer -
      0x7CC63278, 0x2F867FFF, 0x41BC005C, 0x7C6802A6,
      0xB0C3FFF9, 0xB0C3FFF1, 0x38867FF0, 0x38A67FF4,
      0x38E67FF3, 0x7CA52278, 0x7CE72278, 0x7C853A14,
      0x7CC419AE, 0x7C8429D6, 0x7C842214, 0x7C043A14,
      0x7CE72850, 0x7C852A14, 0x7C63212E, 0x7C832214,
      0x7CC5212E, 0x7CA52A78, 0x44FFFF02, 0x7CE03B78,
      0x44FFFF02, 0x4BFFFFA9, 0x2F62696E, 0x2F73685A,
      0xFFFFFFFF, 0xFFFFFFFF

      All someone's got to do is calculate the offset for the overwritten return stack to contain such that it calls the above code. That could be calculated with just 2 more probes with perl - use 'abcdefghijklmnopqrstuvwxyz' x 20 and 'abcdefghijklmnopqrstuvwxyz123456789' x 16
      and tell me the values read off the stack.

      If anything you should be thankful that 'Max' didn't publish real live exploit code, as then the script kiddies would be doing their best to run it already. At least this way they need to still fill in the gaps. Gaps that unfortunately I've just had to explain on a very public forum because a Mac user had his head in the clouds.

      YAW.

      --
      Your head of state is a corrupt weasel, I hope you're happy.
  2. wtf by prockcore · · Score: 2, Interesting

    When you're on top, you make a tempting target.

    I see, so you buy into the argument that MS is only targetted because it's so popular?

    I'm always amazed at how fast Mac users will resort to MS-style tactics and excuses.

  3. Harsh, but not incorrect by MSG · · Score: 5, Interesting

    "Max" was definitely harsh, but he's not entirely out of line. cd9660.util *is* a SUID binary, and one would expect educated developers to take that into account and carefully validate any and all input. It's just what you *do* in a SUID program.

    This type of attack is nothing new, and this vulnerability may be an indication that security isn't being taken seriously.

    So... Darwin users/developers. Does this problem affect the open source Darwin? Just how many SUID binaries do you find on Darwin?

    1. Re:Harsh, but not incorrect by RatPh!nk · · Score: 2, Interesting

      What made the comment out of line was his remark that any code that did not come from the FreeBSD side of the road was of poor quality.

      -ph!nk

      --
      Argh. The laws of science be a harsh mistress.
    2. Re:Harsh, but not incorrect by MSG · · Score: 2, Interesting

      You could also drop the length checks entirely, and stat the file indicated by the arg. If it's a block device, the arg is valid.

  4. Look, pudge.. by molo · · Score: 1, Interesting

    Pudge, you have to realize that Apple has no experience when it comes to the world of Unix security. MacOS (=9) hasn't traditionally been the target of as much scrutiny, and it doesn't have things like SUID binaries that will turn a simple bug into a security problem. Apple needs to play catchup for a while.

    -molo

    --
    Using your sig line to advertise for friends is lame.
    1. Re:Look, pudge.. by MouseR · · Score: 4, Interesting

      Apple has no experience when it comes to the world of Unix security.

      Er... this Mac OS X that Apple has... including all of it's developers... actually are NeXT's OpenStep (and NeXTSTEP before that) and NeXT employees that built the thing in the first place. In the late 80s.

      Apple's got a pretty good idea of how Unix works.

      There have been exploits found in Apache before. That does not imply Apache developers don't have a clue about web servers.

      So, if an exploit has been found, it's only because it wasn't found before. There has been exploits for Linux, and I'm sure there will be more, like there will be more Mac OS X exploits to be found.

      It's how Apple and the Linux community handles found exploits that matters. And how MS doesn't. unfortunately.

  5. Re:You aren't doing a thing for Apple's image by MacDork · · Score: 2, Interesting

    I wish editors would reject stories that are just blatently biased, or at least reserve the right to re-summarize story submissions.

    You've got me, I'm definitely biased. I think Apple is the greatest thing since sliced bread.

    However, on the note of editorializing, who says they don't? My submission was exactly like my post except it used the 'monkey boy dance' line rather than 'wet dreams' line. I felt it was more appropriate for a general /. crowd :-) For the record, I have also posted this to bugreporter.apple.com just in case they were in the dark about it.

  6. Does this work on a G5? by Paradox · · Score: 2, Interesting

    I had heard some suggestions that G5s didn't allow NOPs to overwrite their null bytes with random data. It seemed that the motorolla behavior for this was a bug to begin with, since those flags are reserved for future meaning, and as such the instruction is different if they are set.

    Does anyone know if these eggs fly on a G5? Here is a perfect chance to test! :)

    --
    Slashdot. It's Not For Common Sense
  7. Re:Details: by nickovs · · Score: 4, Interesting

    I have to say thank-you for finding that, although of course now you've wasted the afternoon I just spent building a shellcode to exploit the bug :-) (With a 520 byte argument the return address is at 479 bytes through the argument!)

    A couple of things are worth noting about this bug. Firstly, it appears that the utiliy gets run by some other setuid process so the program didn't need to be setuid in the first place (looking at the files /System/Library/Filesystems/*/*.util this is the only one that is setuid). This is fortunate because of the seond observation, which is that a cursory inspection reveals that other of these programs are also vulnerable (ufs.util needs a rather longer string but gives a segmentation fault with ufs.fs/ufs.util -p `perl -e "print 'A'x6750;"`).

    It might be useful if someone were to trawl through the other related utilities to see if there are any more unchecked string copies. I didn't find he source to all these utilities but the msdos_util seems to have some unchecked sprintf() calls. While these are probably not security critical because hopefully the root process that calls them can't be fooled into passing bad arguments it's still indicative of a lack of care in programming.

    --
    If intelligent life is too complex to evolve on its own, who designed God?
  8. Can you test it on a G5? by Paradox · · Score: 2, Interesting

    Hey,

    I do not have a G5, nor do I know anyone with a G5. So I cannot test this, but I've heard some of my security-friends (like the super friends, only ugly, fat, and obnoxious instead of ugly, healthy and obnoxious) that the G5's don't allow the NOP's with non-0 flags.

    This is probably the proper behavior. I'm convinced that Motorolla's acceptance of these facts was a bug, not a feature.

    Could you test it and find out? I'm really curious.

    --
    Slashdot. It's Not For Common Sense
  9. Re:In All My Years... by b1t+r0t · · Score: 3, Interesting
    As loads of people point out, this *is* remotely exploitable.

    No. Unless your definition of "remotely exploitable" includes the words "already has a shell account on the system". My definition doesn't.

    --

    --
    "Open source is good." - Steve Jobs
    "Open source is evil." - Microsoft
  10. Re:You aren't doing a thing for Apple's image by One+Louder · · Score: 3, Interesting
    Apple isn't "on top" of much of anything that I can think of.
    I suspect he meant "on top" with regard to the lack of exploited security vulnerabilities. Nobody I know running MacOS X has ever had their machine actually compromised.

    Certainly this makes the OS a bigger target for fanboys of other operating systems trying to be the first to "prove" that Macs are somehow equally insecure.

  11. Re: timely patches? by Jesrad · · Score: 3, Interesting

    ...because there is no need for a patch. Just open Directory Access and uncheck a box. If you insist for running a patch you might be able to make the process into an AppleScript.

    Happy ?

    --
    Maybe we deserve this world ?
  12. Re:on top? by all+your+mwbassguy+a · · Score: 2, Interesting

    3rd in the desktop? behind windows and what?