lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 22 Apr 2009 11:31:25 +0200
From: Tavis Ormandy <taviso@....lonestar.org>
To: full-disclosure@...ts.grok.org.uk
Cc: bugtraq@...urityfocus.com
Subject: Re: [Bkis-07-2009] 010 Editor Multiple Buffer
	Overflow Vulnerabilities

Bkis <svrt@...v.com.vn> wrote:
> Bkis has just found many vulnerabilities in the software, related to the
> processing of 010 Editor Binary Template files (“.bt”) and 010 Editor
> Script Files (“.1sc”). These vulnerabilities are very dangerous due to the
> fact that they allow hackers to execute malicious code on users’ systems.
> 

I think you're confused, these scripts can execute programs, create and
modify files, modify running processes, and so on. Perhaps you're confusing
the concept of "modelines" with editor automation (modelines are hints to
the editor how to display a file, and are untrusted, where as automating an
editor requires the ability to modify files, create filters and so on to be
useful).

The documentation is online here:

http://www.sweetscape.com/010editor/manual/FuncInterface.htm
http://www.sweetscape.com/010editor/manual/EditingProcesses.htm

Start here:

int Exec( const char program[], const char arguments[] ) 

Executes an external application using the given program and arguments.

> Rating this vulnerability high severity, Bkis recommends that users 
> should update their software to the latest version.

This is like saying "A vulnerability has been fixed parsing perl scripts,
upgrade and it's safe to run hostile.pl again", It's obviously not the case.
While what you describe is clearly a bug, it's hard to see any security
impact - users couldnt previously safely execute untrusted scripts, and
after upgrading they still can't.

You may want to read up on modelines, Guninski famously broke vim modelines
in interesting ways several times.

-- 
-------------------------------------
taviso@....lonestar.org | finger me for my pgp key.
-------------------------------------------------------

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists