Package: unhide
Version: 20080519-2
Followup-For: Bug #520254
Using unhide with option brute causes segfaults due to various flaws in the
source.
See this patch:
--- ../unhide-20080519.orig/unhide-linux26.c 2009-11-01 22:05:39.000000000
+0100
+++ ./unhide-linux26.c 2009-11-01 23:46:25.000000000 +0100
@@ -1,5 +1,5 @@
/* Unhide yje...@security-projects.com */
-
+#define _GNU_SOURCE
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
@@ -12,6 +12,7 @@
#include <signal.h>
#include <stdlib.h>
#include <sys/sysinfo.h>
+#include <sys/wait.h>
#define COMMAND "nice -20 ps axHo sess,pid | awk '{ print $2 }' | grep -v PID"
@@ -40,7 +41,7 @@
count = 0;
- if ( errno == 0) {
+ if (dirp != NULL) {
while ((ptr = readdir(dirp)) != NULL) {
@@ -48,9 +49,9 @@
count++;
}
- if ( count > 3 ) { return(1) ;}
+ if ( count > 3 ) { closedir(dirp); return(1) ;}
- else {return(0);}
+ else {closedir(dirp); return(0);}
}
@@ -75,6 +76,10 @@
FILE *fich_tmp ;
fich_tmp=popen (COMMAND, "r") ;
+ if (fich_tmp == NULL) {
+ printf("popen failed while checking pid %d (memory, or
something set by errno: %s)\n", tmppid, strerror(errno));
+ return;
+ }
while (!feof(fich_tmp) && ok == 0) {
@@ -95,6 +100,10 @@
FILE *fich_session ;
fich_session=popen (SESSION, "r") ;
+ if (fich_session == NULL) {
+ printf("popen failed while session checking pid %d
(memory, or something set by errno: %s)\n", tmppid, strerror(errno));
+ return;
+ }
while (!feof(fich_session) && ok == 0) {
@@ -114,6 +123,10 @@
FILE *fich_pgid ;
fich_pgid=popen (PGID, "r") ;
+ if (fich_pgid == NULL) {
+ printf("popen failed while pgid checking pid %d
(memory, or something set by errno: %s)\n", tmppid, strerror(errno));
+ return;
+ }
while (!feof(fich_pgid) && ok == 0) {
@@ -159,6 +172,7 @@
cmdfile=fopen (cmd, "r") ;
+ if (cmdfile != NULL) {
while (!feof (cmdfile)) {
@@ -166,6 +180,8 @@
printf ("Command: %s\n\n", cmdcont);
}
+ fclose(cmdfile);
+ }
}
}
}
@@ -277,7 +293,7 @@
void checksched_getaffinity() {
int syspids;
- unsigned long mask;
+ cpu_set_t mask;
printf ("[*]Searching for Hidden processes through sched_getaffinity()
scanning\n\n") ;
@@ -288,7 +304,7 @@
errno= 0 ;
- ret = sched_getaffinity(syspids, sizeof(unsigned int), &mask);
+ ret = sched_getaffinity(syspids, sizeof(mask), &mask);
if ( errno == 0) {
@@ -380,11 +396,16 @@
printf ("[*]Searching for Hidden processes through sysinfo()
scanning\n\n") ;
fich_proceso=popen (COMMAND, "r") ;
+ if (fich_proceso == NULL) {
+ printf("popen failed while checking sysinfo (memory, or
something set by errno: %s)\n", strerror(errno));
+ return;
+ }
+ buffer[499] = '\0';
while (!feof(fich_proceso)) {
- fscanf( fich_proceso, "%s", &buffer );
+ fscanf( fich_proceso, "%499s", &buffer[0] );
contador++;
}
@@ -407,7 +428,6 @@
void brute() {
int i=0;
- int vpid;
int allpids[maxpid] ;
int x;
int y;
@@ -416,7 +436,7 @@
printf ("[*]Starting scanning using brute force against PIDS\n\n") ;
- for(x=0; x < 299; x++) {
+ for(x=0; x < 300; x++) {
allpids[x] = '\0' ;
}
@@ -429,22 +449,24 @@
for (i=0; i < maxpid; i++) {
+ int vpid;
+ int status;
errno= 0 ;
- if (vfork() == 0) {
-
- vpid = getpid();
+ if ((vpid = vfork()) == 0) {
- allpids[vpid] = '\0';
+ allpids[getpid()] = '\0';
- exit(1);
+ _exit(1);
}
- waitpid(vpid);
+ waitpid(vpid, &status, 0);
}
+ /* processes that quit at this point in time create false positives */
+
for(y=0; y < maxpid; y++) {
if (allpids[y] != '\0') {
@@ -497,5 +519,5 @@
}
-
+ return 0;
}
Regards,
Walter Doekes
-- System Information:
Debian Release: 5.0.3
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.26-2-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
unhide depends on no packages.
unhide recommends no packages.
Versions of packages unhide suggests:
pn rkhunter <none> (no description available)
-- no debconf information
_______________________________________________
forensics-devel mailing list
forensics-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/mailman/listinfo/forensics-devel
