Thursday, 22 February 2018

InfoSect's Month of Pointless Bugs (#27)

Dr Silvio Cesare

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #27

In bsdgames/atc

typedef struct {
        char    name[10];
        char    host[256];
        char    game[256];
        int     planes;
        int     time;
        int     real_time;
} SCORE;

...
        SCORE           score[100], thisscore;

               if ((pw = (struct passwd *) getpwuid(getuid())) == NULL) {
                        fprintf(stderr, 
                                "getpwuid failed for uid %d.  Who are you?\n",
                                (int)getuid());
                        return (-1);
                }
                strcpy(thisscore.name, pw->pw_name);

Login names can be greater than 10 bytes. Note also that the game doesn't check that dropping privs may fail, leading to a potential privileged buffer overflow.

Exploiting the Lorex 2K Indoor Wifi at Pwn2Own Ireland

Introduction In October InfoSect participated in Pwn2Own Ireland 2024 and successfully exploited the Sonos Era 300 smart speaker and Lor...