{"id":6277,"date":"2017-01-23T14:08:04","date_gmt":"2017-01-23T22:08:04","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-128\/"},"modified":"2017-01-23T14:08:04","modified_gmt":"2017-01-23T22:08:04","slug":"news-128","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-128\/","title":{"rendered":"SSD Advisory – BusyBox (local) cmdline stack buffer overwrite"},"content":{"rendered":"
\n

Vulnerability Description<\/strong>
BusyBox provides an arp<\/code> applet which is missing an array bounds check for command-line parameter IFNAME<\/code>. It is therefore vulnerable to a command-line based local stack buffer overwrite effectively allowing local users to write past a 16 bytes fixed stack buffer. This leads to two scenarios, one (A) where an IOCTL for GET_HW_ADDRESS (SIOCGIFHWADDR<\/code>) fails and results in a corrupted va_list<\/code> being passed to *printf()<\/code> and one (B) where an attacker might provide valid params for the IOCTL and trick the program to proceed and result in a RET eip overwrite<\/code> eventually gaining code execution.<\/p>\n

<\/span><\/p>\n

Technical Details<\/strong>
By providing an overly long string for param IFNAME<\/code> while setting -D<\/code> (read HW Address from IFACE) and -s<\/code> (set new entry) a strcpy operation can be reached that allows to write past the stack buffer ifreq.ifr_name[IFANMESIZ]<\/code> [5,6]<\/p>\n<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n