Re: CVE Request: Planeshift buffer overflow

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/17/2012 08:52 AM, Andres Gomez wrote:
> Name: Stack-based buffer overflow in Planeshift 0.5.9 and earlier 
> Software: Planeshift 0.5.9 Software link:
> http://www.planeshift.it/ Vulnerability Type: Buffer overflow
>
> Vulnerability Details:
>
> There is a buffer overflow in planeshift/src/client/chatbubbles.cpp
> line 223:
>
> . . .
>
> // align csString align = chatNode->GetAttributeValue("align"); 
> align.Downcase(); if (align == "right") chat.textSettings.align =
> ETA_RIGHT; else if (align == "center") chat.textSettings.align =
> ETA_CENTER; else chat.textSettings.align = ETA_LEFT;
>
> // prefix 223>  strcpy(chat.effectPrefix, 
> chatNode->GetAttributeValue("effectPrefix"));
>
> //enabled . . .
>
> this line reads a tag inside chatbubbles.xml called effectPrefix.
> If that string is very long, for example:
>
> <chat type="say" enabled="yes" colourR="186" colourG="168"
> colourB="126" shadowR="108" shadowG="98" shadowB="73" align="left" 
> effectPrefix="chatbubble_AAAAA....AAAAA" />
>
> It will overwrite effectPrefix[64] buffer, which can lead even to
> arbitrary code execution.
>
>
> Could a CVE be assigned to this issue?

I'm not familiar with this software (it's a game?) the chat bubbles,
can they come from remote users (like some sort of internal game chat)?


> Thanks,
>
> Andres Gomez.


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPtV+JAAoJEBYNRVNeJnmTRtcP/R+w6vfmWPlfF2DDjxmOS25f
qpAnIWXWQWAQ0xv1AJbbeuCd/ChnYG6BHiRpe3RQFHm2LeFJugfWIMrwJyWyVkuD
cf4/5+hxhc7tY8vze51C9budUQZoeo+jalGt5eoOk0mCUqDR2RoLn8Pg2UEzsloO
HNNWlWJ2xP3Qt2cuHbBMQIa3RUA0vFh+cUSP2mvLe//pS/FljLt5k78kV1wzAUEw
DsuxNYoNJ5DoMWSCltsXSsN0tbIGr5vlHkHkWfXzs7POB2dRtJakJj30AkPdpt7r
FZuwoEuvPRsLgrNa6LFpnsbFI9Bw0St3K+XKm+upa0S0o8plI/iUYFhuZOdTkpyf
GaHtSpRoeVZgW8M/yvM3k3Lh/nPywI/ORBrdLcELrgrjMTh/rMyAgh4IBYTYNpaX
Lyca8ZigbmyHzgWF8v/oujdu+9Pu9sdxlPxLMBv9omYa9Sqr8M6U0+OPbXDYzJD1
NQ1ReT2YYQml/KcX3H9/IQ9TL+/1/lpWnY5pEbx6ya/X7jVNKkkDOBAkwkSzgEgD
x5xYC8hxhXSDov3iIpzeZBlN3shRP+BKXCbhbb9ZxPN0fOI8IuJNVUaSzAxTQb5f
+jJuoWVkdr2Rp5cmOonX1wFo1LRvNH8ZD6FXOb+ano+Hwktm+aJCjyxpSSmqXOHb
mYPLwJ9J3ZupuIgFY/lx
=EgCI
-----END PGP SIGNATURE-----