bugtraq - Re: GNU Sharutils buffer overflow vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 11 Apr 2004 00:14:48 +0400 (MSD)
From: Dan Yefimov <dan@...M.integrate.com.ru>
To: Shaun Colley <shaunige@...oo.co.uk>
Cc: bugtraq@...urityfocus.com,
	<full-disclosure-request@...ts.netsys.com>
Subject: Re: GNU Sharutils buffer overflow vulnerability.

On Tue, 6 Apr 2004, [iso-8859-1] Shaun Colley wrote:

> I have written a simple patch below to fix the buffer
> overflow bug:
> 
> 
> --- shar-bof.patch ---
> 
> --- shar.1.c    2004-04-06 16:26:55.000000000 +0100
> +++ shar.c      2004-04-06 16:32:32.000000000 +0100
> @@ -1905,7 +1905,7 @@
>         break;
> 
>        case 'o':
> -       strcpy (output_base_name, optarg);
> +       strncpy (output_base_name, optarg,
> sizeof(output_base_name));
>         if (!strchr (output_base_name, '%'))
>           strcat (output_base_name, ".%02d");
>         part_number = 0;
> --- EOF ---
> 
Your patch isn't quite correct since you at least forgot about 
strcat(output_base_name, ".%02d") following patched code. You didn't also
notice subsequent using output_base_name as a format string which may produce 
overflow of output_filename[] because of unnoticed percent symbols passed in. 
Attached a patch accounting for that.
-- 

    Sincerely Your, Dan.

View attachment "sharutils-4.2.1-bof.patch" of type "TEXT/PLAIN" (1313 bytes)