Full Disclosure mailing list archives
Re: Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations
From: Markus Kern <markus-kern () gmx net>
Date: Wed, 19 Jan 2005 13:11:43 +0100
On Tuesday, January 18, 2005, 11:59:51 PM Markus Kern <markus-kern () gmx net> wrote:
On Monday, January 17, 2005, 9:40:47 PM Rafel Ivgi, The-Insider <theinsider () 012 net il> wrote:
Application: Kazaa Vendors: http://www.kazaa.com Versions: kazaa lite k++(probably all others too...) Platforms: Windows Bug: Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations Exploitation: Remote With Browser Date: 17 Jan 2005 Author: Rafel Ivgi, The-Insider E-Mail: the_insider () mail com Website: http://theinsider.deep-ice.com
<snip toc>
Kazaa is currently the worlds most common P2P file sharing application. When installing Kazaa a new protocol is installed named sig2dat.
This is incorrect. Kazaa itself does not install a handler for the 'sig2dat' URIs. In fact it doesn't even know about them. The sig2dat URIs are created and handled by a third party tool [1] which contains the described flaws and happens to be included in the (unofficial) Kazaa Lite package.
I have to correct myself slightly here. After closer inspection it turns out that more recent versions of Kazaa Lite include a utility called K-Sig [2] instead of sig2dat. K-Sig does not share any code with sig2dat. It is not clear which of the two was used by the original poster but it seems neither of them do any explicit filtering to prevent directory traversal attacks.
The official Kazaa from http://www.kazaa.com does not handle sig2dat URIs and is not vulnerable.
This protocol contain an integer overflow vulnerability which may cause a crash and may allow remote execution of code. There is another vulnerability in the File: parameter which allows creating files in arbitrary locations and committing Denial Of Service.
[1] sig2dat, http://www.geocities.com/vlaibb/tools.html (The design and code of this thing are horrific and there are no doubt plenty of other bugs to be found)
[2] K-Sig, http://sourceforge.net/projects/hasnain -- Markus Kern _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations Rafel Ivgi, The-Insider (Jan 18)
- Re: Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations Thierry Zoller (Jan 19)
- Re: Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations Berend-Jan Wever (Jan 19)
- Re: Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations Markus Kern (Jan 19)
- Re: Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations Markus Kern (Jan 19)