lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 7 Mar 2008 08:53:33 -0500
From: "David Judais" <david.judais@...glemail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerability in Linux Kiss Server v1.2

Sorry, my response became detached from the original thread somehow.

On Wed, Mar 5, 2008 at 4:29 PM, David Judais <david.judais@...glemail.com>
wrote:

> Why isn't there a patch?
>
> > From: vashnukad@...hnukad.com
> >
> Site: http://www.vashnukad.com
>
> Application: Linux Kiss Server v1.2
>
> Type: Format strings
>
> Priority: Medium
>
> Patch available: No
>
>
> The Linux Kiss Server contains a format strings vulnerability that, if run
> in foreground mode, can be leveraged for access. The vulnerability is
> demonstrated in the code below:
>
>             Function log_message():
>
>                   if(background_mode == 0)
>
>                   {
>
>                     if(type == 'l')
>
>                       fprintf(stdout,log_msg);
>
>
>                     if(type == 'e')
>
>                       fprintf(stderr,log_msg);
>
>                     free(log_msg);
>
>                   }
>
>
>
>
>             Function kiss_parse_cmd():
>
>
>
>                   /* check full command name */
>
>                   if (strncmp(cmd, buf, cmd_len))
>
>                       {
>
>                          asprintf(&log_msg,"unknow command: `%s'", buf);
>
>                          log_message(log_msg,'e');
>
>                          goto error;
>
>                       }
>
>                   buf += cmd_len;
>
>
>
> So putting something like %n%n%n in 'buf' you can trigger the
> vulnerability.
>
>
> --
>
> Name: Vashnukad
>
> E-mail: vashnukad@...hnukad.com
>
> Site: http://www.vashnukad.com
>
>
>
>
> --
>
> Name: Vashnukad
>
> e-mail: vashnukad@...hnukad.com
>
> Site: http://www.vashnukad.com
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists