Re: Buffer overflow in awk

[Jeff Fields <admin () forsite net>]

[xplosive@dr4g0n]~$ echo 'BEGIN {system("id")}' | awk -f /dev/stdin
uid=500(xplosive) gid=500(xplosive) groups=500(xplosive)

?

On Sun, 17 Mar 2002, Pavel Kankovsky wrote:

> Date: Sun, 17 Mar 2002 15:48:43 +0100 (MET)
> From: Pavel Kankovsky <peak () argo troja mff cuni cz>
> To: Kurt Seifried <bugtraq () seifried org>
> Cc: vuln-dev () securityfocus com
> Subject: Re: Buffer overflow in awk
>
> On Fri, 15 Mar 2002, Kurt Seifried wrote:
>
> > So you are willing to guarentee to us that this awk bug will never be
> > exploitable by an attacker in any circumstance? Cool. Oh wait, that's
> > totally bogus.
>
> No. I can guarantee that a person who can pass arbitrary values to awk's
> -f option controls the account running such an instance of (GNU) awk
> without having to resort to the buffer overflow being discussed.
>
> Just try those two commands:
>
>   echo 'BEGIN {system("command of your choice")}' > /tmp/blah
>   awk -f blah
>
> Or this single command:
>
>   echo 'BEGIN {system("command of your choice")}' | awk -f /dev/stdin
>
> Of course, the buffer overflow is a bug and it should be fixed.
> But it is not a real security hole because -f's parameter is a trusted
> input channel.
>
> --Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
> "Resistance is futile. Open your source code and prepare for assimilation."

-- 

---------------------------------------------------
Jeff Fields <admin () forsite net> - 1 (877) 467-2748
ForSite Web Services, Inc. - http://www.forsite.com
---------------------------------------------------