libxview buffer overflows
Program: libxview
the XView toolkit library, an OpenLook user
interface development toolkit.
Version: current (3.2p1.4)
surely older ones (3.x verified).
OS: any OS running X11 and xview.
Problem: buffer overflows.
Impact: any setuid program using xview is vulnerable
and can be used to execute arbitrary
commands as the owner of the program.
hello,
guess what ! Yet another buffer overflow. This one is
in the xview library. Well, I should say buffer
overflowS because there are several overflows in the
code.
Most of them happen while getting and environment
variable and copying it into a fixed-length buffer.
I included in this post the summary of the overflows
i found.
Note that there may be others as well.
Affected functions:
------------------ dflts_put.c
static void node_write(path_name, file_name, status, flag)
------------------ font.c
static Font_locale_info *find_font_locale_info(server, avlist)
------------------ wckind.c
void _wckind_init()
------------------ server.c
Pkg_private int server_init(parent, server_public, avlist)
static void server_setlocale_to_default(server)
static void server_init_atoms(server_public)
------------------ txt_e_menu.c
Pkg_private char * textsw_get_extras_filename(mi)
------------------ tty_map_key.c
Pkg_private void ttysw_readrc(ttysw)
I included this list of vulnerabilities since I'm too lazy
and don't have time to make a patch.
For the exploits, well, eh, spot a setuid root xview program
and implement a standart buffer overflow with any affected
environment variable:
DEFAULT_FILES, OPENWINHOME, HOME, XVIEW_DEFAULT_LOCALE,
PROMPT,
that's all folks,
plaguez
dube0866@eurobretagne.fr
------------------------
plaguez / libpcap
dube0866@eurobretagne.fr
http://xxx.xxx.xxx
------------------------
ps: if you have a box at the end of a line
and would like to see www.plaguez.org instead
of xxx.xxx.xxx, please mail me ! :)