full-disclosure - Re: FluxBox crash vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20041127013131.GA2472@sentinelchicken.org>
From: tim-security at sentinelchicken.org (Tim)
Subject: Re: FluxBox crash vulnerability

> Fluxbox always crashes totally while executing XMAN with long value of 
> '-title' parameter. Simple usage example:
> 
> $ xman -title `perl -e 'print "X" x 10000 '`
> 
> It was tested on 0.9.10 version and some older ones. Probably all are affected.

Please see tests below:

-----snip-----
~> fluxbox -version
Fluxbox 0.9.9 : (c) 2001-2004 Henrik Kinnunen 
~> uname -o -r
2.6.8 GNU/Linux
~> cat /etc/debian_version
3.1
~> xman -title `perl -e 'print "X" x 8936 '`
X connection to :0.0 broken (explicit kill or server shutdown).
----/snip-----

So, the gist of it is, on the version I am running I could never get
fluxbox to crash.  However, large titles did cause problems.  with
anything above, say, 5000 characters, the window comes up, but is very
unresponsive.  Resizing the window causes display refresh problems for
that window, and the whole window manager is generally slow.  

However, as soon as I close the window, everything returns to normal.
In addition, using any number of characters above 8936 does not cause
this behavior at all, because for 8937 and above, the title bar displays
nothing and everything is peachy.  Large titles just under that amount
cause issues, and it appears the X's in the title wrap around an
overwrite themselves in the display.  When there were problems with the
window, sometimes (maybe 1 in 4) I get the error message you see above.

I get these same symptoms when using large titles on other programs as
well.

tim