Date: Wed, 9 Aug 2006 22:20:19 +0200
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	news@...uriteam.com, full-disclosure@...ts.grok.org.uk,
	vuln@...unia.com
Subject: Multiple buffer-overflows in AlsaPlayer 0.99.76


#######################################################################

                             Luigi Auriemma

Application:  AlsaPlayer
              http://www.alsaplayer.org
Versions:     <= 0.99.76 and current CVS
Platforms:    *nix and others
Bugs:         A] buffer-overflow in reconnect's redirection
              B] buffer-overflow in GTK playlist
              C] buffer-overflow in cddb_lookup
Exploitation: remote and local
Date:         09 Aug 2006
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


AlsaPlayer is a well known and used open source media player originally
built around the Alsa drivers.


#######################################################################

======
2) Bug
======

---------------------------------------------
A] buffer-overflow in reconnect's redirection
---------------------------------------------

The function which handles the HTTP connections is vulnerable to a
buffer-overflow that happens when it uses sscanf for copying the URL in
the Location's field received from the server into the redirect buffer
of only 1024 bytes declared in http_open.

>From reader/http/http.c:

static int reconnect (http_desc_t *desc, char *redirect)
{
    char request [2048];
    char response [10240];
    ...
    } else if (rc == 302) {
            s = strstr(response, "302");
        if (s) {
            //alsaplayer_error("%s", s);
            s = strstr(response, "Location: ");
            if (s && redirect) {
                /* Parse redirect */
                if (sscanf(s, "Location: %[^\r]", redirect)) {
                    /* alsaplayer_error("Redirection: %s", redirect); */
                }           
            }
            return 1;
        }
    ...


----------------------------------
B] buffer-overflow in GTK playlist
----------------------------------

A buffer-overflow exists in the functions which add items to the
playlist when the GTK interface is used (so the other interfaces are
not affected by this problem): new_list_item and CbUpdated in
interface/gtk/PlaylistWindow.cpp.
The best way for exploiting this bug is through the following URLs
(perfect, for example, if AlsaPlayer is the default player of the web
browser):

  http://aaaaa(more_than_1024_chars)aaaaa
or
  http://127.0.0.1/aaaaa(more_than_1024_chars)aaaaa.mp3


---------------------------------
C] buffer-overflow in cddb_lookup
---------------------------------

AlsaPlayer automatically queries the CDDB server specified in its
configuration (by default freedb.freedb.org) when the user choices the
CDDA function for playing audio CDs.
The function which queries the server uses a buffer of 20 bytes and one
of 9 for storing the category and ID strings received from the server
while the buffer which contains this server's response is 32768 bytes
long.
Naturally for exploiting this bug the attacker must have control of the
freedb server specified in the AlsaPlayer's configuration.

>From input/ccda/cdda_engine.c:

char * cddb_lookup (char *address, char *char_port, int discID, struct cd_trk_list *tl)
{
    int port = atoi (char_port);
    int server_fd, i, j, n;
    int total_secs = 0, counter = 0;
    char *answer = NULL, *username, *filename, categ[20], newID[9];
    char msg[BUFFER_SIZE], offsets[BUFFER_SIZE], tmpbuf[BUFFER_SIZE];
    char hostname[MAXHOSTNAMELEN], server[80];
    ...
        /* copy the match to the category */
        j = 0;
        while (answer[i] != ' ') 
            categ[j++] = answer[i++];
        categ[j++] = '\0';

        /* copy the new cdID */
        j = 0; 
        i++;
        while (answer[i] != ' ') 
            newID[j++] = answer[i++];
        newID[j++] = '\0';
    }
    ...


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/alsapbof.zip

usage examples:
A] nc -l -p 80 -v -v -n < alsapbof_a.txt
B] alsaplayer http://`perl -e 'print "a"x2000'`
C] nc -l -p 888 -v -v -n < alsapbof_c.txt


#######################################################################

======
4) Fix
======


I have tried to contact the developer some days ago but seems that the
program is no longer supported (the latest version is three years old).


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org
http://mirror.aluigi.org

Powered by blists - more mailing lists