Bugtraq mailing list archives
Re: CERT Advisory CA-97.20 - JavaScript Vulnerability
From: dube0866 () EUROBRETAGNE FR (Nicolas Dubee)
Date: Sat, 1 Jan 1994 06:28:53 +0100
plaguez security advisory n. 6 libxview buffer overflows Program: libxview the XView toolkit library, an OpenLook user interface development toolkit. Version: current (3.2p1.4) surely older ones (3.x verified). OS: any OS running X11 and xview. Problem: buffer overflows. Impact: any setuid program using xview is vulnerable and can be used to execute arbitrary commands as the owner of the program. hello, guess what ! Yet another buffer overflow. This one is in the xview library. Well, I should say buffer overflowS because there are several overflows in the code. Most of them happen while getting and environment variable and copying it into a fixed-length buffer. I included in this post the summary of the overflows i found. Note that there may be others as well. Affected functions: ------------------ dflts_put.c static void node_write(path_name, file_name, status, flag) ------------------ font.c static Font_locale_info *find_font_locale_info(server, avlist) ------------------ wckind.c void _wckind_init() ------------------ server.c Pkg_private int server_init(parent, server_public, avlist) static void server_setlocale_to_default(server) static void server_init_atoms(server_public) ------------------ txt_e_menu.c Pkg_private char * textsw_get_extras_filename(mi) ------------------ tty_map_key.c Pkg_private void ttysw_readrc(ttysw) I included this list of vulnerabilities since I'm too lazy and don't have time to make a patch. For the exploits, well, eh, spot a setuid root xview program and implement a standart buffer overflow with any affected environment variable: DEFAULT_FILES, OPENWINHOME, HOME, XVIEW_DEFAULT_LOCALE, PROMPT, that's all folks, plaguez dube0866 () eurobretagne fr ------------------------ plaguez / libpcap dube0866 () eurobretagne fr http://xxx.xxx.xxx ------------------------ ps: if you have a box at the end of a line and would like to see www.plaguez.org instead of xxx.xxx.xxx, please mail me ! :)
Current thread:
- Re: CERT Advisory CA-97.20 - JavaScript Vulnerability Nicolas Dubee (Dec 31)
- <Possible follow-ups>
- CERT Advisory CA-97.20 - JavaScript Vulnerability CERT Advisory (Jul 08)
- Re: CERT Advisory CA-97.20 - JavaScript Vulnerability Dominick Matthias PN OIL 6 (Jul 10)
- Re: CERT Advisory CA-97.20 - JavaScript Vulnerability Drew Dean (Jul 10)
- Re: CERT Advisory CA-97.20 - JavaScript Vulnerability Kool Hercs (Jul 10)