[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <66e421d70803070553h2891a9beq1472bdf156ef41bc@mail.gmail.com>
Date: Fri, 7 Mar 2008 08:53:33 -0500
From: "David Judais" <david.judais@...glemail.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerability in Linux Kiss Server v1.2
Sorry, my response became detached from the original thread somehow.
On Wed, Mar 5, 2008 at 4:29 PM, David Judais <david.judais@...glemail.com>
wrote:
> Why isn't there a patch?
>
> > From: vashnukad@...hnukad.com
> >
> Site: http://www.vashnukad.com
>
> Application: Linux Kiss Server v1.2
>
> Type: Format strings
>
> Priority: Medium
>
> Patch available: No
>
>
> The Linux Kiss Server contains a format strings vulnerability that, if run
> in foreground mode, can be leveraged for access. The vulnerability is
> demonstrated in the code below:
>
> Function log_message():
>
> if(background_mode == 0)
>
> {
>
> if(type == 'l')
>
> fprintf(stdout,log_msg);
>
>
> if(type == 'e')
>
> fprintf(stderr,log_msg);
>
> free(log_msg);
>
> }
>
>
>
>
> Function kiss_parse_cmd():
>
>
>
> /* check full command name */
>
> if (strncmp(cmd, buf, cmd_len))
>
> {
>
> asprintf(&log_msg,"unknow command: `%s'", buf);
>
> log_message(log_msg,'e');
>
> goto error;
>
> }
>
> buf += cmd_len;
>
>
>
> So putting something like %n%n%n in 'buf' you can trigger the
> vulnerability.
>
>
> --
>
> Name: Vashnukad
>
> E-mail: vashnukad@...hnukad.com
>
> Site: http://www.vashnukad.com
>
>
>
>
> --
>
> Name: Vashnukad
>
> e-mail: vashnukad@...hnukad.com
>
> Site: http://www.vashnukad.com
>
>
Content of type "text/html" skipped
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists