Application: Gnome nautilus

Versions: 2.2.1 and others

Bug: Buffer Overflow

Exploitation: unknown

Date: 12.04.04

Author: gsicht

e-mail: nothing.king (at) firemail (dot) de [email concealed]

#####################

# the bug: #

#####################

i discovered a buffer overflow vulnerability in gnome nautilus.

i don't know many details about this overflow, but if someone is possible to create a directory with a name of 255 x A,

nautilus won't be able to handle with the directory. The creating of the directory could be possible through a ftp server.

example:

http://www.k-otik.com/exploits/08.11.0x82-wu262-advanced.c

if you delete your directory(not in a shell), you can find it in your trash. now clear it, and you'll get an error with a segmentation fault.

if you enter the directory in your trash with a double click and also do this with the next directory, you'll get a segmentation fault, too.

[ reply ]