Date: Wed, 21 Oct 1998 00:15:12 -0700 (PDT)
From: Kevin Vajk <kvajk@ricochet.net>
To: David Luyer <luyer@ucs.uwa.edu.au>
Subject: Re: buffer overflow in netkit rwhod/Debian netstd-3.07-2hamm.2
Cc: security-audit@ferret.lmh.ox.ac.uk
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
Send mail to mime@docserver.cac.washington.edu for more info.
---1463811834-2088382526-908954112=:4807
Content-Type: TEXT/PLAIN; charset=US-ASCII
On Wed, 21 Oct 1998, David Luyer wrote:
> There's a (sort-of exploitable as DoS, possibly exploitable in more interesting
> ways[1] but unlikely) buffer overflow in rwhod (netkit-rwho-0.10/rwhod in Debian
> netstd-3.07-2hamm.2).
Neat... If we're gonna be changing rwhod, let's also improve the
verify function by lifting the OpenBSD version, since it checks for things
that our one doesn't. (Nothing directly exploitable, per se.)
In particular, the OpenBSD version will reject a hostname whose first
character is a "-", which could trip up any poorly written scripts which
try to parse this stuff.
I've written up an example patch on a RedHat system. It's not The Real
Thing since I haven't tested it at all yet. (All I've verified is that it
compiles, really.)
Maybe you want to play with this a little?
- Kevin Vajk
<kvajk@ricochet.net>
---1463811834-2088382526-908954112=:4807
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="netkit-rwho-0.10-overflow.patch"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.3.96.981021001512.4807B@darkstar.localdomain>
Content-Description: netkit-rwho-0.10-overflow.patch
ZGlmZiAtZCAtciAtdSAtUCBuZXRraXQtcndoby0wLjEwLm9yaWcvcndob2Qv
cndob2QuYyBuZXRraXQtcndoby0wLjEwL3J3aG9kL3J3aG9kLmMNCi0tLSBu
ZXRraXQtcndoby0wLjEwLm9yaWcvcndob2Qvcndob2QuYwlTdW4gSnVuICA4
IDE4OjI0OjE3IDE5OTcNCisrKyBuZXRraXQtcndoby0wLjEwL3J3aG9kL3J3
aG9kLmMJV2VkIE9jdCAyMSAwMDowNDowNyAxOTk4DQpAQCAtOTMsNyArOTMs
NyBAQA0KICNlbmRpZg0KIA0KIHN0YXRpYyBpbnQgY29uZmlndXJlKGludCBz
KTsNCi1zdGF0aWMgaW50IHZlcmlmeShjb25zdCBjaGFyICpuYW1lKTsNCitp
bnQgdmVyaWZ5KGNoYXIgKnApOw0KIHN0YXRpYyBpbnQgZ2V0bG9hZGF2Zyhk
b3VibGUgcHRyWzNdLCBpbnQgbik7DQogDQogLyoNCkBAIC0xOTAsNyArMTkw
LDggQEANCiAJfQ0KIAlpZiAoKGNwID0gaW5kZXgobXluYW1lLCAnLicpKSAh
PSBOVUxMKQ0KIAkJKmNwID0gJ1wwJzsNCi0Jc3RybmNweShteXdkLndkX2hv
c3RuYW1lLCBteW5hbWUsIHNpemVvZiAobXluYW1lKSAtIDEpOw0KKwlzdHJu
Y3B5KG15d2Qud2RfaG9zdG5hbWUsIG15bmFtZSwgc2l6ZW9mKG15d2Qud2Rf
aG9zdG5hbWUpIC0gMSk7DQorCW15d2Qud2RfaG9zdG5hbWVbc2l6ZW9mKG15
d2Qud2RfaG9zdG5hbWUpIC0gMV0gPSAnXDAnOw0KIAlnZXRrbWVtKDApOw0K
IAlpZiAoKHNrID0gc29ja2V0KEFGX0lORVQsIFNPQ0tfREdSQU0sIDApKSA8
IDApIHsNCiAJCXN5c2xvZyhMT0dfRVJSLCAic29ja2V0OiAlbSIpOw0KQEAg
LTIwMCw2ICsyMDEsNyBAQA0KIAkJc3lzbG9nKExPR19FUlIsICJzZXRzb2Nr
b3B0IFNPX0JST0FEQ0FTVDogJW0iKTsNCiAJCWV4aXQoMSk7DQogCX0NCisJ
bWVtc2V0KCZzaW5lLCAwLCBzaXplb2Yoc2luZSkpOw0KIAlzaW5lLnNpbl9m
YW1pbHkgPSBBRl9JTkVUOw0KIAlzaW5lLnNpbl9wb3J0ID0gc3AtPnNfcG9y
dDsNCiAJaWYgKGJpbmQoc2ssIChzdHJ1Y3Qgc29ja2FkZHIgKikmc2luZSwg
c2l6ZW9mKHNpbmUpKSA8IDApIHsNCkBAIC0yODQsMTcgKzI4NiwzMiBAQA0K
ICAqIGFuZCBvdGhlciBmdW5uaWVzIGJlZm9yZSBhbGxvd2luZyBhIGZpbGUN
CiAgKiB0byBiZSBjcmVhdGVkLiAgU29ycnksIGJ1dCBibGFua3MgYXJlbid0
IGFsbG93ZWQuDQogICovDQotc3RhdGljIGludA0KLXZlcmlmeShjb25zdCBj
aGFyICpuYW1lKQ0KK2ludA0KK3ZlcmlmeShwKQ0KKwlyZWdpc3RlciBjaGFy
ICpwOw0KIHsNCi0JcmVnaXN0ZXIgaW50IHNpemUgPSAwOw0KKwljaGFyIGM7
DQogDQotCXdoaWxlICgqbmFtZSkgew0KLQkJaWYgKCFpc2FzY2lpKCpuYW1l
KSB8fCAhKGlzYWxudW0oKm5hbWUpIHx8IGlzcHVuY3QoKm5hbWUpKSkNCi0J
CQlyZXR1cm4gKDApOw0KLQkJbmFtZSsrLCBzaXplKys7DQorCS8qDQorCSAq
IE1hbnkgcGVvcGxlIGRvIG5vdCBvYmV5IFJGQyA4MjIgYW5kIDEwMzUuICBU
aGUgdmFsaWQNCisJICogY2hhcmFjdGVycyBhcmUgYS16LCBBLVosIDAtOSwg
Jy0nIGFuZCAuIEJ1dCB0aGUgb3RoZXJzDQorCSAqIHRlc3RlZCBmb3IgYmVs
b3cgY2FuIGhhcHBlbiwgYW5kIHdlIG11c3QgYmUgbW9yZSBwZXJtaXNzaXZl
DQorCSAqIHRoYW4gdGhlIHJlc29sdmVyIHVudGlsIHRob3NlIGlkaW90cyBj
bGVhbiB1cCB0aGVpciBhY3QuDQorCSAqLw0KKwlpZiAoKnAgPT0gJy4nIHx8
ICpwID09ICctJykNCisJCXJldHVybiAwOw0KKwl3aGlsZSAoKGMgPSAqcCsr
KSkgew0KKwkJaWYgKCgnYScgPD0gYyAmJiBjIDw9ICd6JykgfHwNCisJCSAg
ICAoJ0EnIDw9IGMgJiYgYyA8PSAnWicpIHx8DQorCQkgICAgKCcwJyA8PSBj
ICYmIGMgPD0gJzknKSkNCisJCQljb250aW51ZTsNCisJCWlmIChjID09ICcu
JyAmJiAqcCA9PSAnLicpDQorCQkJcmV0dXJuIDA7DQorCQlpZiAoYyA9PSAn
LicgfHwgYyA9PSAnLScpDQorCQkJY29udGludWU7DQorCQlyZXR1cm4gMDsN
CiAJfQ0KLQlyZXR1cm4gc2l6ZSA+IDA7DQorCXJldHVybiAxOw0KIH0NCiAN
CiANCkBAIC0zMTIsNiArMzI5LDcgQEANCiAJc3RydWN0IHV0bXAgKnVwdHI7
DQogCWRvdWJsZSBhdmVucnVuWzNdOw0KIAl0aW1lX3Qgbm93ID0gdGltZShO
VUxMKTsNCisJaW50IGxlbjsNCiANCiAJKHZvaWQpZHVtbXk7DQogDQpAQCAt
MzMwLDEwICszNDgsMjQgQEANCiAJCXdoaWxlICgodXB0ciA9IGdldHV0ZW50
KCkpIT1OVUxMKSB7DQogCQkJaWYgKHVwdHItPnV0X25hbWVbMF0NCiAJCQkm
JiB1cHRyLT51dF90eXBlID09IFVTRVJfUFJPQ0VTUykgew0KKw0KKwkJCQlp
ZihzaXplb2YodXB0ci0+dXRfbGluZSkgPA0KKwkJCQkJCXNpemVvZih3ZS0+
d2VfdXRtcC5vdXRfbGluZSkpIHsNCisJCQkJCWxlbiA9IHNpemVvZih1cHRy
LT51dF9saW5lKTsNCisJCQkJfSBlbHNlIHsNCisJCQkJCWxlbiA9IHNpemVv
Zih3ZS0+d2VfdXRtcC5vdXRfbGluZSk7DQorCQkJCX0NCiAJCQkJYmNvcHko
dXB0ci0+dXRfbGluZSwgd2UtPndlX3V0bXAub3V0X2xpbmUsDQotCQkJCSAg
IHNpemVvZih1cHRyLT51dF9saW5lKSk7DQotCQkJCWJjb3B5KHVwdHItPnV0
X25hbWUsIHdlLT53ZV91dG1wLm91dF9uYW1lLA0KLQkJCQkgICBzaXplb2Yo
dXB0ci0+dXRfbmFtZSkpOw0KKwkJCQkgICBsZW4pOw0KKw0KKwkJCQlpZihz
aXplb2YodXB0ci0+dXRfbmFtZSkgPA0KKwkJCQkJCXNpemVvZih3ZS0+d2Vf
dXRtcC5vdXRfbmFtZSkpIHsNCisJCQkJCWxlbiA9IHNpemVvZih1cHRyLT51
dF9uYW1lKTsNCisJCQkJfSBlbHNlIHsNCisJCQkJCWxlbiA9IHNpemVvZih3
ZS0+d2VfdXRtcC5vdXRfbmFtZSk7DQorCQkJCX0NCisJCQkJYmNvcHkodXB0
ci0+dXRfbmFtZSwgd2UtPndlX3V0bXAub3V0X25hbWUsIGxlbik7DQorDQog
CQkJCXdlLT53ZV91dG1wLm91dF90aW1lID0gaHRvbmwodXB0ci0+dXRfdGlt
ZSk7DQogCQkJCWlmICh3ZSA+PSB3bGFzdCkNCiAJCQkJCWJyZWFrOw0K
---1463811834-2088382526-908954112=:4807--
