full-disclosure - Missing string length check in Horde

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <427881C4.1010802@yapsoft.it>
Date: Wed May  4 10:23:15 2005
From: yap at yapsoft.it (Andrea Parrella)
Subject: Missing string length check in Horde

The Horde Framework has several classes for the creation of forms. For
example, to create a form with a domain field you just have to create an
instance of the Horde_Form class and to call the addVariable() method.

$form->addVariable(_("Domain name"), "domain_name", "text", true, false,
null, array(\"/^[a-zA-Z0-9\-\.]+$/\", 60, 60));

addVariable() takes as last argument an array which allows to specify
some parameters depending on the field type. For the "text" field it
takes 3 values: a regular expression to check characters' validity, the
dimension of the html textbox and the length of the inserted characters.
In the case above, the addVariable() generates:

<input type="text" name="domain_name" size="60" value=""
id="domain_name" maxlength="60" />

The most interesting thing in those classes is that they allow to
validate inputs. In fact, you can call the method validate() which
returns false if validation fails. There isn't a check of the length in
the text field. In fact notwithstanding maxlenght parameter is 60, if a
malicious user tries to insert a longer text (overriding the browser
limitation), the form will be validated. The last two parameters are
only used to generate HTML tags. This could lead to some security
problems. If a developer assumes that the validate() method does the
check itself and for examples he passes the string to a program which
doesn't perform right bound checking, it could result in a buffer
overflow. On Sunday, I got in touch with Horde Team and they added the
patch on the cvs:

http://cvs.horde.org/diff.php/framework/Form/Form.php?r1=1.322&r2=1.323&ty=u

Regards

Andrea Parrella
http://www.yapsoft.it