LinPopUp version 1.2.0 has a buffer overflow in the strexpand() function.
d31de35666d78f705405cfb23c8c4a2a6ffc96ab00efea6d5a9f7692f2a7ccb4
From djb@cr.yp.to Wed Dec 15 14:20:14 2004
Date: 15 Dec 2004 08:10:44 -0000
From: D. J. Bernstein <djb@cr.yp.to>
To: securesoftware@list.cr.yp.to, jeanmarcj@usa.net
Subject: [remote] [control] LinPopUp 1.2.0 overflows sub_string buffer
Stephen Dranger, a student in my Fall 2004 UNIX Security Holes course,
has discovered a remotely exploitable security hole in LinPopUp, an
instant-messaging tool. I'm publishing this notice, but all the
discovery credits should be assigned to Dranger.
You are at risk if you use LinPopUp to reply to a message received from
the network or any other source that could be controlled by an attacker.
Whoever sent that message then has complete control over your account:
he can read and modify your files, watch the programs you're running,
etc.
Proof of concept: On an x86 computer running FreeBSD 4.10, as root, type
cd /usr/ports/net/linpopup
make install
to download and compile the LinPopUp program, version 1.2.0 (current
FreeBSD ports version). Then, as any user, save the file 3.msg attached
to this message, and type
cat 3.msg >> /var/db/linpopup/messages.dat
to simulate receipt of 3.msg from the network. Then type
LinPopUp
and click on Reply. Unauthorized result: a file named x is removed from
the current directory.
Here's the bug: In string.c, strexpand() uses strcpy() to copy from
replace_string, which can have as many as 100 bytes, to a 50-byte
sub_string array.
---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
[ Part 2, Application/OCTET-STREAM 5.4KB. ]
[ Unable to print this part. ]