Mailing-List: contact securesoftware-help@list.cr.yp.to; run by ezmlm Delivered-To: mailing list securesoftware@list.cr.yp.to Received: (qmail 21708 invoked by uid 1017); 15 Dec 2004 08:16:58 -0000 Date: 15 Dec 2004 08:16:58 -0000 Message-ID: <20041215081658.21707.qmail@cr.yp.to> Mail-Followup-To: securesoftware@list.cr.yp.to, bhaak@gmx.net Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html. From: "D. J. Bernstein" To: securesoftware@list.cr.yp.to, bhaak@gmx.net Subject: [remote] [control] vilistextum 2.6.6 get_attr overflows temp buffer Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="4Ckj6UjgE2iN1+kY" Content-Disposition: inline --4Ckj6UjgE2iN1+kY Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Ariel Berkman, a student in my Fall 2004 UNIX Security Holes course, has discovered a remotely exploitable security hole in vilistextum, an HTML-to-text converter. I'm publishing this notice, but all the discovery credits should be assigned to Berkman. You are at risk if you take a web page (or any other source that could be controlled by an attacker) and feed it through vilistextum. (The vilistextum documentation does not tell users to avoid taking input from the network.) Whoever provides that web page then has complete control over your account: he can read and modify your files, watch the programs you're running, etc. Proof of concept: On an x86 computer running FreeBSD 4.10, type wget http://umn.dl.sourceforge.net/sourceforge/vilistextum/vilistextum-2.6.6.tar.gz gunzip < vilistextum-2.6.6.tar.gz | tar -xf - cd vilistextum-2.6.6 ./configure gmake to download and compile the vilistextum program, version 2.6.6 (current). Then save the file 12.html attached to this message, and type src/vilistextum 12.html 12.txt with the unauthorized result that a file named x is removed from the current directory. (I tested this with a 540-byte environment, as reported by printenv | wc -c.) Here's the bug: In html.c, get_attr() reads any amount of data into a 32768-byte temp[] array. ---D. J. Bernstein, Associate Professor, Department of Mathematics, Statistics, and Computer Science, University of Illinois at Chicago --4Ckj6UjgE2iN1+kY Content-Type: text/html; charset=unknown-8bit Content-Disposition: attachment; filename="12.html" Content-Transfer-Encoding: quoted-printable bold italic underlined emphasized stro= ng

Hypertext links:
W= 3C Web site
--4Ckj6UjgE2iN1+kY--