[<prev] [next>] [day] [month] [year] [list]
Message-ID: <200310221448.RAA23206@home.ntrl.net>
From: guninski at guninski.com (Georgi Guninski)
Subject: Sylpheed-claws format string bug, yet still sylpheed much better
than windows
Georgi Guninski security advisory #61, 2003
Sylpheed-claws format string bug, yet still sylpheed much better than windows
Systems affected:
Sylpheed-claws 0.9.6 - 0.9.4
Fixed in CVS
Risk: Medium
Date: 22 October 2003
Legal Notice:
This Advisory is Copyright (c) 2003 Georgi Guninski.
You may distribute it unmodified.
You may not modify it and distribute it or distribute parts
of it without the author's written permission - this especially applies to
so called "vulnerabilities databases" and securityfocus, microsoft, cert
and mitre.
If you want to link to this content use the URL:
http://www.guninski.com/sylph.html
Anything in this document may change without notice.
Disclaimer:
The information in this advisory is believed to be true though
it may be false.
The opinions expressed in this advisory and program are my own and
not of any company. The usual standard disclaimer applies,
especially the fact that Georgi Guninski is not liable for any damages
caused by direct or indirect use of the information or functionality
provided by this advisory or program. Georgi Guninski bears no
responsibility for content or misuse of this advisory or program or
any derivatives thereof.
Description:
There is an exploitable format string in sylpheed claws which may be
exploited by malicous SMTP server.
Details:
The problem seems in:
send_message.c
alertpanel_error_log(err_msg);
The format string is missing.
How to reproduce:
Create a test account with smtp server localhost:1234
Then do:
perl -e 'print "535 failed %x%x%n\r\n"' | nc -l -p 1234
Then send a message.
Actual result - sylpheed crashes.
Vendor status:
Notified on Fri, 3 Oct 2003
It was fixed in CVS on the same day.
Fix:
http://cvs.sourceforge.net/viewcvs.py/sylpheed-claws/sylpheed-claws/src/send_message.c?r1=1.18&r2=1.19&diff_format=u
===================================================================
RCS file: /cvsroot/sylpheed-claws/sylpheed-claws/src/send_message.c,v
retrieving revision 1.18
retrieving revision 1.19
diff -u -r1.18 -r1.19
--- sylpheed-claws/sylpheed-claws/src/send_message.c 2003/09/27 21:01:26 1.18
+++ sylpheed-claws/sylpheed-claws/src/send_message.c 2003/10/03 17:39:39 1.19
@@ -608,7 +608,7 @@
if (log_msg)
log_warning("%s\n", log_msg);
if (err_msg) {
- alertpanel_error_log(err_msg);
+ alertpanel_error_log("%s", err_msg);
g_free(err_msg);
}
}
Regards,
Georgi Guninski
http://www.guninski.com
Powered by blists - more mailing lists