Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 74705 - net-im/linpopup: remotely exploitable buffer overflow (just in 1.2.0?)
Summary: net-im/linpopup: remotely exploitable buffer overflow (just in 1.2.0?)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B2 [glsa] koon
Keywords:
Depends on:
Blocks:
 
Reported: 2004-12-16 16:20 UTC by Sascha Silbe
Modified: 2005-01-04 13:35 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments
File 3.msg from advisory (bug74705-3.msg,3.91 KB, application/octet-stream)
2004-12-16 16:21 UTC, Sascha Silbe
no flags Details
string.c.diff (string.c.diff,1.30 KB, patch)
2004-12-30 06:56 UTC, Thierry Carrez (RETIRED)
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Sascha Silbe 2004-12-16 16:20:59 UTC
The following advisory from securesoftware@list.cr.yp.to is for LinPopUp 1.2.0. I was not able to get net-im/linpopup-2.0.2 to SegFault or remove a file (as described in the advisory) using the given exploit, but inspecting the source shows the vulnerability still exists.

PS: This is last one from securesoftware@list.cr.yp.to for now, the Q finally is empty. Yeah! :)

Date: 15 Dec 2004 08:10:44 -0000
From: "D. J. Bernstein" <djb@cr.yp.to>
Subject: [remote] [control] LinPopUp 1.2.0 overflows sub_string buffer
To: securesoftware@list.cr.yp.to, jeanmarcj@usa.net
X-HELOcheck: OK: FQDN
Mailing-List: contact securesoftware-help@list.cr.yp.to; run by ezmlm
Mail-Followup-To: securesoftware@list.cr.yp.to, jeanmarcj@usa.net
Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html.

[-- Attachment #1 [details] --]
[-- Type: text/plain, Encoding: 7bit, Size: 1.3K --]

Stephen Dranger, a student in my Fall 2004 UNIX Security Holes course,
has discovered a remotely exploitable security hole in LinPopUp, an
instant-messaging tool. I'm publishing this notice, but all the
discovery credits should be assigned to Dranger.

You are at risk if you use LinPopUp to reply to a message received from
the network or any other source that could be controlled by an attacker.
Whoever sent that message then has complete control over your account:
he can read and modify your files, watch the programs you're running,
etc.

Proof of concept: On an x86 computer running FreeBSD 4.10, as root, type

   cd /usr/ports/net/linpopup
   make install

to download and compile the LinPopUp program, version 1.2.0 (current
FreeBSD ports version). Then, as any user, save the file 3.msg attached
to this message, and type

   cat 3.msg >> /var/db/linpopup/messages.dat

to simulate receipt of 3.msg from the network. Then type

   LinPopUp

and click on Reply. Unauthorized result: a file named x is removed from
the current directory.

Here's the bug: In string.c, strexpand() uses strcpy() to copy from
replace_string, which can have as many as 100 bytes, to a 50-byte
sub_string array.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
Comment 1 Sascha Silbe 2004-12-16 16:21:29 UTC
Created attachment 46179 [details]
File 3.msg from advisory
Comment 2 Matthias Geerdsen (RETIRED) gentoo-dev 2004-12-18 13:57:27 UTC
mholzer since you have been dealing with the ebuild, can you verify/advise?

Also 1.2.0 should maybe be considered for removal from the tree.

___

http://securitytracker.com/alerts/2004/Dec/1012542.html
Comment 3 Thierry Carrez (RETIRED) gentoo-dev 2004-12-21 07:00:41 UTC
======================================================
Candidate: CAN-2004-1282
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1282
Reference: MISC:http://tigger.uic.edu/~jlongs2/holes/linpopup.txt

Buffer overflow in the strexpand function in string.c for LinPopUp
1.2.0 allows remote attackers to execute arbitrary code via a crafted
message that is not properly handled during a Reply operation.
======================================================
Comment 4 Thierry Carrez (RETIRED) gentoo-dev 2004-12-30 06:56:32 UTC
Created attachment 47207 [details, diff]
string.c.diff

Patch from http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=287044
This applies cleanly to our stable (2.0.2) version and probably others.
Comment 5 Thierry Carrez (RETIRED) gentoo-dev 2004-12-30 06:58:37 UTC
No metadata.
mholzer/vapier : could you please apply patch (probably to all versions) and bump ?
Comment 6 SpanKY gentoo-dev 2004-12-30 13:15:54 UTC
i dont know why you thought i could help, i'm not in the ChangeLog :P ... i'm not your security lacky you know !

version bumped to 2.0.4 and removed the older ebuilds ... x86 was the only one to have a stable version, amd64/ppc were added with 2.0.3, but as unstable

new 2.0.4 is marked x86 stable and amd64/ppc unstable
Comment 7 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2004-12-30 14:29:53 UTC
Thx vapier, you just signed yourself over to Security:P
Comment 8 Thierry Carrez (RETIRED) gentoo-dev 2005-01-01 13:59:10 UTC
vapier: 2.0.4 still needs patch applied. Could you please bump to -r1 ?
(I really should take time to read that quiz)
Comment 9 SpanKY gentoo-dev 2005-01-01 14:13:48 UTC
added 2.0.4-r1 to cvs with patch
Comment 10 Thierry Carrez (RETIRED) gentoo-dev 2005-01-01 14:15:25 UTC
Thx, really ready now. Draft submitted, security please review
Comment 11 Thierry Carrez (RETIRED) gentoo-dev 2005-01-04 13:35:14 UTC
GLSA 200501-01