bugtraq - inetutils tftp client, DNS resolving bofs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20041025205639.2c4aaefd.infamous41md@hotpop.com>
Date: Mon, 25 Oct 2004 20:56:39 -0400
From: infamous41md@...pop.com
To: bugtraq <bugtraq@...urityfocus.com>
Subject: inetutils tftp client, DNS resolving bofs

Subject:

GNU tftp client remote buffer overflows.

++++++++++++++++++++++++++++++++++++++++++++

Product:

The tftp client that comes with the inetutils package.  It's found on all unices
I know of.

++++++++++++++++++++++++++++++++++++++++++++

Vulnerable:

inetutils-1.4.2 was the only version audited.

++++++++++++++++++++++++++++++++++++++++++++

Summary:

Untrusted data from DNS resolved hostname is copied into finite static buffers
without any bounds checking. We can overflow several buffers located in the
.bss.  Also located in the .bss are function pointers used to implement ftp
commands, so exploitation with code execution is possible.

++++++++++++++++++++++++++++++++++++++++++++

Details:

The overflows all occur thanks to gethostbyname() returned data.  Instead of
copying that data using the length of the destination buffer, the length of the
source buffer is used instead, or no length at all in the case of strcpy().  An
attacker could configure their DNS server maliciously, or a local attacker on a
LAN could spoof replies to neighbors to exploit this.

main.c:227:		bcopy(host->h_addr, &peeraddr.sin_addr, host->h_length);
main.c:228:		strcpy(hostname, host->h_name);
main.c:366:		bcopy(hp->h_addr, (caddr_t)&peeraddr.sin_addr, hp->h_length);  
main.c:369:		strcpy(hostname, hp->h_name);
main.c-457:	    bcopy(hp->h_addr, (caddr_t)&peeraddr.sin_addr, hp->h_length);
main.c:461:		strcpy(hostname, hp->h_name);

++++++++++++++++++++++++++++++++++++++++++++

Vendor:

Was notified weeks ago, and has corrected the problem in new version.

-- 
-sean