|
Sybase: xp_freedll Buffer Overflow
November 26, 2002
To determine if your Sybase installations have this vulnerability, download
AppDetective™ for Sybase from:
http://www.appsecinc.com/products/appdetective/sybase/
Risk level: High
Versions Affected: Sybase Adaptive Server 12.0 and 12.5. This vulnerability is exploitable on both Sybase 12.5 and Sybase 12.0 for all platforms. Despite the reference to Windows DLLs, this vulnerability does affect Sybase running on UNIX.
Threat: Allows a non-privileged login to gain full control of the server
Summary:
The extended stored procedure xp_freedll contains a buffer overflow that may allow an attacker to overwrite the stack and execute arbitrary code under the security context of the server. Execute permissions are granted to public in the sybsystemprocs database on this extended stored procedure.
Details:
Sybase Adaptive Server provides an extended stored procedure (ESP) called xp_freedll in the database sybsystemprocs. This ESP is used to release a DLL that has been loaded by another extended stored procedure.
Xp_freedll accepts a single parameter that is the name of the DLL to free. Xp_freedll does not validate the length of the string passed into the first parameter. It then attempts to copy an overly long string into a small memory buffer. This memory copy results in the stack and the stack pointer being overwritten with the buffer. Once the stack pointer is overwritten, execution can be redirected to an arbitrary location in memory and opcodes injected into the long string passed to the ESP can be executed. This allows the attacker to run arbitrary code under the security context of the extended stored procedure server.
Below is an example of overflowing the buffer using the SQL tool isql.exe.
Memory corruption first occurs with a buffer of length 45.
1> xp_freedll 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.dll'
2> GO
Msg 11496, Level 16, State 7:
Procedure 'xp_freedll', Line 2:
Cannot read from site 'MRFREEZE_XP'. Please check the XP Server error log file for detailed error description. (return status = -6)
With a buffer of 53 bytes in length, an exception is thrown.
1> xp_freedll 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.dll'
2> GO
Encountered an exception(0) in ESP xp_freedll in DLL sybsyesp. If this is an user DLL check the code else contact Sybase Technical Support. (return status = 1)
The following entries are recorded into the event logs.
11403: Encountered an exception(0) in ESP xp_freedll in DLL sybsyesp. If this is an user DLL check the code else contact Sybase Technical Support.
11403: Encountered an exception(193) in ESP xp_freedll in DLL sybsyesp. If this is an user DLL check the code else contact Sybase Technical Support.
11403: Encountered an exception(997) in ESP xp_freedll in DLL sybsyesp. If this is an user DLL check the code else contact Sybase Technical Support.
At 54 bytes in length, the follow memory locations appear in the event logs:
11451: MRFREEZE_XP: XP Server Error: 16142/10/1: Server process address 0x696c6c not in pool in 'srv_senddone()' .
11451: MRFREEZE_XP: XP Server Error: 16142/10/1: Server process address 0x696c6c not in pool in 'srv_sendinfo()' .
11451: MRFREEZE_XP: XP Server Error: 16142/10/1: Server process address 0x696c6c not in pool in 'srv_sendstatus' .
At 55 bytes in length, the follow memory locations appear in the event logs:
11451: MRFREEZE_XP: XP Server Error: 16142/10/1: Server process address 0x642e5858 not in pool in 'srv_senddone()' .
Notice that the memory location has been modified to include 5858 which is the X we used in the buffer overflow.
As we continue to increase the buffer size, we see that the address is completely overwritten by the buffer.
11451: MRFREEZE_XP: XP Server Error: 16142/10/1: Server process address 0x58585858 not in pool in 'srv_sendstatus' .
Fix:
Execute permissions on the extended stored procedure xp_freedll in the sybsystemprocs database should be revoked from public.
You should also apply the following patches:
12.5.0.2 - 11/14/2002
12.0.0.6 ESD#1 - 11/5/2002
These patches can be downloaded from http://downloads.sybase.com/swd/swx
|
