Re: Analyze binary for holes

The most effective way is to debug the executables, and look for vulnerable function calls.
Check that it does (or does not) check for boundaries for potential buffer overflows.
Check that the writer has not ignored and directly accessed rewritable memory space, instead of using format strings when dealing with strings etc.

SUID roots et al, gives a way for a vulnerable program to be exploited for privilege escalation, it does NOT mean the program IS vulnerable, although it could be.

HTH, kind regards

• Original Message ----- From: "Peter Bondra" <olafandjasper@hushmail.com> To: <vuln-dev@securityfocus.com> Sent: Wednesday, July 30, 2003 2:20 AM Subject: Analyze binary for holes

Hello
I am interested in how you may go about analyzing a binary file to determine potential format string or buffer overflow holes.

The platforms I am testing are: SunOs Solaris 2.7/8/9(SPARC) and Windows NT/2000/XP.

This is my process, maybe you could direct and fill in the massive blanks:

UNIX:
In the unix world my first step is to list out the SUID-root files. My next step is to identify which files have potential vulnerabilities. On the Unix side I have used strings, but what does that tell me about. I have seen a few mallocs, callocs, and things that look like a format string for a printf... But not sure what to do next...SO I was thinking of brute forcing the binary command line args and/or environmental vars to see if I can dump core..

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Can you identify potential format string vulnerabilities from binary? Can you identify potential buffer overflow vulns. from binary?

WINDOWS:
I have no idea how to recognize a vulnerable program in the Windows word.Is there anything like SUID-roor, etc??

Thanks Received on Thu Jul 31 12:15:13 2003