unhide (part #3)
Stack overflow in unhide. There is a mismatch between the maxpathlen from a readlink (it gets both sizes wrong in any case).
An attack scenario might be that a rootkit is installed by an attacker then gets code execution (again presumably) when the sysadmin tries to "unhide" the rootkit.
char cmdcont[1000] ;
...
char proc_exe[512] ;
...
sprintf(mypath,"/proc/%d",my_pid);
statuscmd = stat(mypath, &buffer) ;
if ((statuscmd == 0) && S_ISDIR(buffer.st_mode))
{
pid_exists[N_PROC] = TRUE ;
strcat(mypath,"/exe") ;
length = readlink(mypath, cmdcont, 1000) ;
if (-1 != length)
{
cmdcont[length] = 0; // terminate the string
// printf("cmdcont(proc_exe) = %s\n", cmdcont) ; //DEBUG
strcpy(proc_exe,cmdcont) ;
}
else
{
strcpy(proc_exe,"unknown exe") ;
}
}
An attack scenario might be that a rootkit is installed by an attacker then gets code execution (again presumably) when the sysadmin tries to "unhide" the rootkit.
char cmdcont[1000] ;
...
char proc_exe[512] ;
...
sprintf(mypath,"/proc/%d",my_pid);
statuscmd = stat(mypath, &buffer) ;
if ((statuscmd == 0) && S_ISDIR(buffer.st_mode))
{
pid_exists[N_PROC] = TRUE ;
strcat(mypath,"/exe") ;
length = readlink(mypath, cmdcont, 1000) ;
if (-1 != length)
{
cmdcont[length] = 0; // terminate the string
// printf("cmdcont(proc_exe) = %s\n", cmdcont) ; //DEBUG
strcpy(proc_exe,cmdcont) ;
}
else
{
strcpy(proc_exe,"unknown exe") ;
}
}