Attachment 10231 Details for Bug 33242

[patch] List of issues with lanbrowser

lisa (text/plain), 1.52 KB, created by Olaf Kirch on 2002-08-23 19:53:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Olaf Kirch

Created: 2002-08-23 19:53:50 UTC

Size: 1.52 KB

patch

obsolete

>
>Buffer overflow in NetManager::processScanResults.
>	The routine just assumes that host names returned by
>	a scan never exceed 4K. However, lisa will broadcast
>	for a "server server" (master browser) and retrieve the
>	scan list from the first host that responds.
>
>	=> root exploit for everyone on the LAN
>
>	Fix1: enable strict mode (i.e. lisa does all the
>		scans herself rather than using a master
>		browser).
>
>	Fix2: use sscanf("...%4095s"), or even better, use
>		code that avoids char buffers entirely:
>
>		QString line;
>		int idx;
>
>		if ((idx = buffer.find('\n')) < 0)
>			idx = buffer.length();
>		line = buffer.left(idx);
>		buffer.remove(0, idx+1);
>
>		if ((idx = line.find(' ')) < 0)
>			continue;
>
>		ipaddr = line.left(idx).toULong();
>		name = line.mid(idx+1);
>
>	or something along these lines. Qt has these cool
>	buffer and string classes that manipulate memory
>	safely...
>
>LANProtocol::lanReadDataFromServer
>	Again, does an sscanf with a fixed size string buffer on
>	potentially dangerous data - twice. Once when extracting
>	the hostname, and once when getting the "short hostname"
>	i.e. the name portion up to the first dot.
>
>LANProtocol::rlanReadDataFromServer
>	Same issue.
>
>	Not sure if the following works, but if it does, this
>	coule be abused for Linux based mail viruses:
>
>		Subject: A funny game
>		Content-Type: text/html
>
>		<IMG SRC="rlan:evil.attacker.org">
>
>Similar problem in netscanner.cpp:
>	It scans for SMB hosts using the nmblookup command, and
>	uses a 1K buffer in sscanf. Most likely not exploitable,
>	but should be fixed as well.
>
>
>
>

Actions: View | Diff

Attachments on bug 33242: 10231 | 10303 | 10309