bugtraq - RE: Ethereal remote buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050309013358.GA27033@cecilija.zesoi.fer.hr>
Date: Wed, 9 Mar 2005 02:33:58 +0100
From: LSS Security <exposed@....hr>
To: bugtraq@...urityfocus.com
Subject: RE: Ethereal remote buffer overflow - addon



Just a little trick to overflow more stack memory in Ethereal.
It is possible to overflow stack with more than 255 - 2 bytes. If radius_len 
is set to 1, in strncpy() line it is subtracted by two and it will be -1 
(0xffffffff -> 4294967295 (unsigned long)).  

packet-3g-a11.c:
----------------
#define MAX_STRVAL 16
...
dissect_a11_radius( tvbuff_t *tvb, int offset, proto_tree *tree, int app_len)
{
...
  size_t     radius_len;
  ...
  guchar     str_val[MAX_STRVAL]; 
  ...
  radius_len = tvb_get_guint8(tvb, offset + 1);
  ...
  strncpy(str_val, tvb_get_ptr(tvb,offset+2,radius_len-2), radius_len-2); 
...
}
----------------


------------------------------------------
Leon Juranic, LSS Security
http://security.lss.hr

"Born under the lucky star magical,
but on this world generally tragical".
                                - Djole