what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

pgn2web.txt

pgn2web.txt
Posted Dec 30, 2004
Authored by Tom Palarz, Kris Kubicki | Site tigger.uic.edu

A buffer overflow vulnerability in pgn2web version 0.3 may allow for system compromise.

tags | advisory, overflow
SHA-256 | 2e63598951739f109975403fa15697d551c2e14bdb634371cfbe0d33d957c80f

pgn2web.txt

Change Mirror Download
From djb@cr.yp.to Wed Dec 15 14:22:17 2004
Date: 15 Dec 2004 08:25:23 -0000
From: D. J. Bernstein <djb@cr.yp.to>
To: securesoftware@list.cr.yp.to, whoggarth@users.sourceforge.net
Subject: [remote] [control] pgn2web 0.3 process_moves overflows token buffer

Tom Palarz and Kris Kubicki, two students in my Fall 2004 UNIX Security
Holes course, have discovered a remotely exploitable security hole in
pgn2web, a converter from PGN-format chess games to web pages. I'm
publishing this notice, but all the discovery credits should be assigned
to Palarz and Kubicki.

You are at risk if you take a PGN file from an email message (or a web
page or any other source that could be controlled by an attacker) and
feed that document through pgn2web. Whoever provides the PGN file then
has complete control over your account: he can read and modify your
files, watch the programs you're running, etc.

The pgn2web documentation does not tell users to avoid taking input from
the network. In fact, one can easily find web pages offering chess games
in PGN format for public use.

Proof of concept: On an x86 computer running FreeBSD 4.10, type

wget http://umn.dl.sourceforge.net/sourceforge/pgn2web/pgn2web-0.3.tar.gz
gunzip < pgn2web-0.3.tar.gz | tar -xf -
cd pgn2web
gcc -Wall -o pgn2web pgn2web.c -DINSTALL_PATH='"./"'

to download and compile the pgn2web program, version 0.3 (current). Then
save the file 45.pgn attached to this message, and type

./pgn2web 45.pgn 45.html

with the unauthorized result that a file named EXPLOITED is created in
the current directory.

Here's the bug: In pgn2web.c, process_moves() uses fscanf() to read any
number of bytes into a 256-byte token array.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

[ Part 2, Application/X-CHESS-PGN 2.6KB. ]
[ Unable to print this part. ]

Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close