InfoSect's Month of Pointless Bugs (#1, #2)

Dr Silvio Cesare

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

None of these have been verified by vendors or authors. Almost everything comes from Kali or Ubuntu repos.

Bug #1

In the lbreakout2 package, a client server Linux game, we have client/client_handlers.c

char client_name[16]; /* our local username */

...

  while ( net_recv_packet() ) {
    if ( msg_is_connectionless() )
       msg_begin_connectionless_reading();
    else
       if ( !socket_process_header( &client ) ) 
          continue;
                        
       type = msg_read_int8();
       switch ( type ) {
       case MSG_LOGIN_OKAY:
         client_id = msg_read_int32();
         strcpy( client_name, msg_read_string() );
         client_printf_chatter( 1, _("%s: connected!"), config.server );
         client_is_connected = 1;
         return;
       case MSG_ERROR:
         client_printf_chatter( 1, _("ERROR: connection refused: %s"), msg_read_string() );
         return;
      }
    }

There is a simple buffer overflow. The server sends a long client_name.

Bug #2
In the mirrormagic Linux game, we have src/files.c
  fclose(file);
  free(filename);

  SetFilePermissions(filename, PERMS_PRIVATE);
}

This is a pretty obvious use-after-free.

Comments

Popular posts from this blog

NetBSD kernel wscons IOCTL vulnerable bug class

Linux Kernel Infoleaks

Memory Bugs in Multiple Linux Kernel Drivers using DebugFS