Buffer Overflow via Environment Variables - Revision history

KirstenS: /* Examples */

2008-08-04T11:53:59Z

‎Examples

KirstenS: /* Examples */

2008-08-04T11:50:57Z

‎Examples

KirstenS: /* Description */

2008-08-04T11:48:43Z

‎Description

Rezos at 22:41, 4 November 2007

2007-11-04T22:41:15Z

Rezos at 21:25, 4 November 2007

2007-11-04T21:25:41Z

Rezos: New page: {{Template:Attack}} ==Description== This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an e...

2007-11-04T21:24:30Z

New page: {{Template:Attack}} ==Description== This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an e...

New page

{{Template:Attack}}

==Description==
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that
they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.

The following conditions must be met to conduct successful attack:
* The application uses environment variables.
* The environment variable exposed to the user is vulnerable to a buffer overflow.
* The vulnerable environment variable uses untrusted data.
* Tainted data used in the environment variables is not properly validated. For instance boundary checking is not done before copying
the input data to a buffer.

==Examples ==

Furthermore the attacker performs the following steps:
* The attacker tries to find an environment variable which can be overwritten for instance by gathering information about the target
host (error pages, software's version number, hostname, etc.).
* The attacker manipulates the environment variable to contain excessive-length content to cause a buffer overflow.
* The attacker potentially leverages the buffer overflow to inject maliciously crafted code in an attempt to execute privileged command on the target environment.

'''Example1'''

Application below gets information about its run environment from environment variables.

<pre>
rezos@dojo-labs ~/owasp/buffer_overflow $ cat bo_env.c
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
char *ptr_h;
char h[64];

ptr_h = getenv("HOME");
if(ptr_h != NULL) {
sprintf(h, "Your home directory is: %s !", ptr_h);
printf("%s\n", h);
}

return 0;
}
</pre>
Application checks the value of the environment variable ''HOME'' (path to the home directory) and stores it. It is done by calling
getenv(3) library function in GNU/Linux. If return value of this function is different than NULL (NULL value means that variable
is not set), then message is created by calling sprintf(3). This function doesn't validate the length of the string, which is going
to be written in the targer 64 char size buffer - h[].

Common program execution:
<pre>
rezos@dojo-labs ~/owasp/buffer_overflow $ ./bo_env
Your home directory is: /home/rezos !
</pre>
Now let's change the value of HOME to 128 'A' characters.
<pre>
rezos@dojo-labs ~/owasp/buffer_overflow $ export HOME=`perl -e 'print "A"x128'`
</pre>
When we run program again, to the buffer h[64] is copied a message,
which has length of (assuming sizeof(char) = 1):
<pre>
strlen("Your home directory is: !") + strlen(ptr_h) = 28 + 128 = 156
</pre>
<pre>
rezos@dojo-labs /home/rezos/owasp/buffer_overflow $ ./bo_env
Your home directory is:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
!
Segmentation fault
rezos@dojo-labs /home/rezos/owasp/buffer_overflow $
</pre>
Program ended with memory segmentation fault, buffer h[] was overwritten.
Using environment variables themselves is not a problem. The real problem is when application lacks their proper validation - size and content. More information about errors related to buffer overflows may be found in the [[Buffer_overflow_attack]] article.

Code injection is performed in the same common way like in buffer overflow attacks with only one difference. The shellcode is placed in environment variable(s).

==Related Threats==

*[[:Category:Command Execution]]

==Related Attacks==

* [[Buffer_overflow_attack]]
* [[Format string attack]]

==Related Vulnerabilities==

* [[Format string]]
* [[Heap overflow]]

==Related Countermeasures==

* [[:Category:Input Validation]]
* Do not expose environment variable to the user.
* Do not use untrusted data in your environment variables.

==Categories==

*[[:Category:Data Structure Attacks]]

@@ Line 44: / Line 44: @@
+}
 </pre>
-The application checks the value of the environment variable ''HOME'' (path to the home directory) and stores it. It is done by calling
+The application checks the value of the environment variable ''HOME'' (path to the home directory) and stores it. It is done by calling the
 getenv(3) library function in GNU/Linux. If the return value of this function is different than NULL (NULL value means that variable
 is not set), then a message is created by calling sprintf(3). This function doesn't validate the length of the string, which is going
@@ Line 58: / Line 58: @@
 rezos@dojo-labs ~/owasp/buffer_overflow $ export HOME=`perl -e 'print "A"x128'`
 </pre>
-When we run program again, to the buffer h[64] is copied a message,
+When we run program again, a message is copied  to the buffer h[64],
-which has length of (assuming sizeof(char) = 1):
+which has a length of (assuming sizeof(char) = 1):
 <pre>
 strlen("Your home directory is:  !") + strlen(ptr_h) = 28 + 128 = 156
@@ Line 71: / Line 71: @@
 rezos@dojo-labs /home/rezos/owasp/buffer_overflow $
 </pre>
-Program ended with memory segmentation fault, buffer h[] was overwritten.
+The program ended with memory segmentation fault, and buffer h[] was overwritten.
 Using environment variables themselves is not a problem. The real problem is when application lacks their proper validation - size and content. More information about errors related to buffer overflows may be found in the [[Buffer_overflow_attack]] article.
-Code injection is performed in the same way as in buffer overflow attacks with only one difference. The shellcode is placed in environment variable(s).
+Code injection is performed in the same way as in buffer overflow attacks with only one difference; the shellcode is placed in environment variable(s).
 ==Related Threats==

← Older revision		Revision as of 22:41, 4 November 2007
Line 98:		Line 98:
	==Categories==		==Categories==

−	*[[:Category:Data Structure Attacks]]	+	[[Category:Data Structure Attacks]]

@@ Line 19: / Line 19: @@
 ==Examples ==
 '''Example1'''
-Application below gets information about its run environment from environment variables.
+The application below gets information about its run environment from environment variables.
 <pre>
@@ Line 50: / Line 44: @@
+}
 </pre>
-Application checks the value of the environment variable ''HOME'' (path to the home directory) and stores it. It is done by calling
+The application checks the value of the environment variable ''HOME'' (path to the home directory) and stores it. It is done by calling
-getenv(3) library function in GNU/Linux. If return value of this function is different than NULL (NULL value means that variable
+getenv(3) library function in GNU/Linux. If the return value of this function is different than NULL (NULL value means that variable
-is not set), then message is created by calling sprintf(3). This function doesn't validate the length of the string, which is going
+is not set), then a message is created by calling sprintf(3). This function doesn't validate the length of the string, which is going
 to be written in the targer 64 char size buffer - h[].
@@ Line 80: / Line 74: @@
 Using environment variables themselves is not a problem. The real problem is when application lacks their proper validation - size and content. More information about errors related to buffer overflows may be found in the [[Buffer_overflow_attack]] article.
-Code injection is performed in the same common way like in buffer overflow attacks with only one difference. The shellcode is placed in environment variable(s).
+Code injection is performed in the same way as in buffer overflow attacks with only one difference. The shellcode is placed in environment variable(s).
 ==Related Threats==

@@ Line 11: / Line 11: @@
 * Tainted data used in the environment variables is not properly validated. For instance boundary checking is not done before copying
 the input data to a buffer.
 ==Examples ==

@@ Line 11: / Line 11: @@
 * Tainted data used in the environment variables is not properly validated. For instance boundary checking is not done before copying
 the input data to a buffer.
 ==Examples ==
@@ Line 20: / Line 19: @@
 * The attacker manipulates the environment variable to contain excessive-length content to cause a buffer overflow.
 * The attacker potentially leverages the buffer overflow to inject maliciously crafted code in an attempt to execute privileged command on the target environment.
 '''Example1'''
@@ Line 89: / Line 89: @@
 * [[Format string]]
 * [[Heap overflow]]
 ==Related Countermeasures==