full-disclosure - Re: Vulnerability in Linux Kiss Server v1.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <66e421d70803051329n12d82a8etf4fc714258025c27@mail.gmail.com>
Date: Wed, 5 Mar 2008 16:29:53 -0500
From: "David Judais" <david.judais@...glemail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerability in Linux Kiss Server v1.2

Why isn't there a patch?

> From: vashnukad@...hnukad.com
>
Site: http://www.vashnukad.com

Application: Linux Kiss Server v1.2

Type: Format strings

Priority: Medium

Patch available: No


The Linux Kiss Server contains a format strings vulnerability that, if run
in foreground mode, can be leveraged for access. The vulnerability is
demonstrated in the code below:

            Function log_message():

                  if(background_mode == 0)

                  {

                    if(type == 'l')

                      fprintf(stdout,log_msg);


                    if(type == 'e')

                      fprintf(stderr,log_msg);

                    free(log_msg);

                  }




            Function kiss_parse_cmd():



                  /* check full command name */

                  if (strncmp(cmd, buf, cmd_len))

                      {

                         asprintf(&log_msg,"unknow command: `%s'", buf);

                         log_message(log_msg,'e');

                         goto error;

                      }

                  buf += cmd_len;



So putting something like %n%n%n in 'buf' you can trigger the vulnerability.


-- 

Name: Vashnukad

E-mail: vashnukad@...hnukad.com

Site: http://www.vashnukad.com




-- 

Name: Vashnukad

e-mail: vashnukad@...hnukad.com

Site: http://www.vashnukad.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/