From djb@cr.yp.to Wed Dec 15 14:22:17 2004
Date: 15 Dec 2004 08:25:23 -0000
From: D. J. Bernstein <djb@cr.yp.to>
To: securesoftware@list.cr.yp.to, whoggarth@users.sourceforge.net
Subject: [remote] [control] pgn2web 0.3 process_moves overflows token buffer

Tom Palarz and Kris Kubicki, two students in my Fall 2004 UNIX Security
Holes course, have discovered a remotely exploitable security hole in
pgn2web, a converter from PGN-format chess games to web pages. I'm
publishing this notice, but all the discovery credits should be assigned
to Palarz and Kubicki.

You are at risk if you take a PGN file from an email message (or a web
page or any other source that could be controlled by an attacker) and
feed that document through pgn2web. Whoever provides the PGN file then
has complete control over your account: he can read and modify your
files, watch the programs you're running, etc.

The pgn2web documentation does not tell users to avoid taking input from
the network. In fact, one can easily find web pages offering chess games
in PGN format for public use.

Proof of concept: On an x86 computer running FreeBSD 4.10, type

   wget http://umn.dl.sourceforge.net/sourceforge/pgn2web/pgn2web-0.3.tar.gz
   gunzip < pgn2web-0.3.tar.gz | tar -xf -
   cd pgn2web
   gcc -Wall -o pgn2web pgn2web.c -DINSTALL_PATH='"./"'

to download and compile the pgn2web program, version 0.3 (current). Then
save the file 45.pgn attached to this message, and type

   ./pgn2web 45.pgn 45.html

with the unauthorized result that a file named EXPLOITED is created in
the current directory.

Here's the bug: In pgn2web.c, process_moves() uses fscanf() to read any
number of bytes into a 256-byte token array.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

    [ Part 2, Application/X-CHESS-PGN  2.6KB. ]
    [ Unable to print this part. ]