bugfindutils - Bugs: bug #19923, root-only buffer overrun in locate...

 
 

bug #19923: root-only buffer overrun in locate from findutils-4.3.x

Submitted by:  James Youngman <jay>
Submitted on:  Mon 21 May 2007 09:44:05 PM UTC  
 
Category: locateSeverity: 6 - Security
Item Group: Wrong resultStatus: Fixed
Privacy: PublicAssigned to: James Youngman <jay>
Originator Name: NixOpen/Closed: Closed
Release: 4.3.5Fixed Release: 4.3.6

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 21 May 2007 10:13:36 PM UTC, comment #1:

Um, if one byte of `what' was always what was overwritten, then -fstack-protector wouldn't have caught this problem. The guard (adjacent to `what') must have been smashed. (This won't smash the return address on 32-bit hosts and will probably not do so on 64-bit hosts either: I'd say `certainly not' only I don't have any 64-bit hosts here to test against.)

(However, I seem to recall that -fstack-protector reorders variables as well as canarying them, in which case your statement is correct when the stack protector is off. I can't recall. Sorry.)

Anonymous
Mon 21 May 2007 09:44:05 PM UTC, original submission:

If root invokes locate, their group ID is set to a random value. The same bug also causes an array overrun past the end of the local array groups[]. The variable which gets overwritten by the buffer overrun on x86 is 'what'. The value of that variable is always changed before it is used, and so I believe that this buffer overrun will not cause a crash. The only effect of the bug therefore would be for locate to change group to a random group ID since groups[0] is uninitialised. On my test system this random group ID is 0 anyway. The effect does not depend on any externally-controllable information, so it is unlikely this is exploitable.

James Youngman <jay>
Project AdministratorIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jay (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 21 May 2007 10:03:49 PM UTCjayPrivacyPrivate=>Public
      Open/ClosedOpen=>Closed
    Mon 21 May 2007 09:53:34 PM UTCjayStatusIn Progress=>Fixed
      Assigned toNone=>jay
      Fixed ReleaseNone=>4.3.6

    Back to the top


    Powered by Savane 3.1-cleanup1