From djb@cr.yp.to Wed Dec 15 14:23:25 2004 Date: 15 Dec 2004 08:33:25 -0000 From: D. J. Bernstein To: securesoftware@list.cr.yp.to, chambers@users.sourceforge.net Subject: [remote] [control] jcabc2ps switch_voice() overflows t1 buffer Tom Palarz and Limin Wang, two students in my Fall 2004 UNIX Security Holes course, have discovered a remotely exploitable security hole in jcabc2ps. I'm publishing this notice, but all the discovery credits should be assigned to Palarz and Wang. You are at risk if you take an ABC file from an email message (or a web page or any other source that could be controlled by an attacker) and feed that document through jcabc2ps. Whoever provides the ABC file then has complete control over your account: she can read and modify your files, watch the programs you're running, etc. The jcabc2ps documentation does not tell users to avoid taking input from the network. Many web pages offer ABC files for public consumption. Proof of concept: On an x86 computer running FreeBSD 4.10, type mkdir jcabc2ps cd jcabc2ps wget http://trillian.mit.edu/~jc/music/abc/src/jcabc2ps-20040902.tar.gz gunzip < jcabc2ps-20040902.tar.gz | tar -xf - make to download and compile the jcabc2ps program, version 20040902 (current). Then change your environment so that the total environment size, as reported by printenv|wc -c, is exactly 333; this particular proof-of-concept attack allows only a very small range of environment sizes. Then save the file 74.abc attached to this message, and type ./jcabc2ps 74.abc > 74.ps with the unauthorized result that a file named x is removed from the current directory. Here's the bug: In parse.c, switch_voice() copies any amount of data into the 201-byte t1[] array. ---D. J. Bernstein, Associate Professor, Department of Mathematics, Statistics, and Computer Science, University of Illinois at Chicago [ Part 2, Text/PLAIN (charset: unknown-8bit) 11 lines. ] [ Unable to print this part. ]