Attachment 32268 Details for Bug 66128

patch made by solar designer

solar (text/plain), 13.51 KB, created by Ludwig Nussel on 2005-03-18 09:19:21 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-03-18 09:19:21 UTC

Size: 13.51 KB

patch

obsolete

>From vendor-sec-admin@lst.de  Thu Mar 17 15:29:32 2005
>Return-Path: <vendor-sec-admin@lst.de>
>X-Original-To: lnussel@wotan.suse.de
>Received: from hermes.suse.de (hermes.suse.de [149.44.160.1])
>	by wotan.suse.de (Postfix) with ESMTP id 0546923F2C1
>	for <lnussel@wotan.suse.de>; Thu, 17 Mar 2005 15:29:32 +0100 (CET)
>Received: by hermes.suse.de (Postfix)
>	id ED4541521EF; Thu, 17 Mar 2005 15:29:31 +0100 (CET)
>Received: from scanhost.suse.de (scanhost.suse.de [149.44.160.36])
>	by hermes.suse.de (Postfix) with ESMTP
>	id E02DBE1CF3; Thu, 17 Mar 2005 15:29:31 +0100 (CET)
>Received: from hermes.suse.de ([149.44.160.1])
> by scanhost.suse.de (scanhost [149.44.160.36]) (amavisd-new, port 10025)
> with ESMTP id 05151-07; Thu, 17 Mar 2005 15:29:29 +0100 (CET)
>Received: from Cantor.suse.de (ns.suse.de [195.135.220.2])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by hermes.suse.de (Postfix) with ESMTP
>	id 9A520110575; Thu, 17 Mar 2005 15:29:29 +0100 (CET)
>Received: from mail.lst.de (verein.lst.de [213.95.11.210])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by Cantor.suse.de (Postfix) with ESMTP id B0B4C15D96F4;
>	Thu, 17 Mar 2005 15:27:19 +0100 (CET)
>Received: from verein.lst.de (localhost [127.0.0.1])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j2HER76s007612;
>	Thu, 17 Mar 2005 15:27:07 +0100
>Received: from mother.openwall.net (mother.openwall.net [195.42.179.200])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with SMTP id j2HEQl6s007592
>	for <vendor-sec@lst.de>; Thu, 17 Mar 2005 15:26:47 +0100
>Received: (qmail 15346 invoked from network); 17 Mar 2005 14:26:41 -0000
>Received: from localhost (HELO pvt.openwall.com) (127.0.0.1)
>  by localhost with SMTP; 17 Mar 2005 14:26:41 -0000
>Received: by pvt.openwall.com (Postfix, from userid 503)
>	id A878729B99; Thu, 17 Mar 2005 17:19:45 +0300 (MSK)
>From: Solar Designer <solar@openwall.com>
>To: Tom Rini <trini@mvista.com>
>Cc: vendor-sec@lst.de, Sam Hartman <hartmans@mit.edu>,
>	Tom Yu <tlyu@mit.edu>, vendor-disclosure@idefense.com
>Subject: Re: [vendor-sec] iDEFENSE Security Advisory [IDEF0866] Multiple Telnet Client slc_add_reply() Buffer Overflow Vulnerability
>Message-ID: <20050317141945.GA15316@openwall.com>
>References: <FB24803D1DF2A34FA59FC157B77C970503E245C8@idserv04.idef.com> <20050219194246.GA7495@openwall.com> <20050316172037.GM793@localhost>
>Mime-Version: 1.0
>Content-Type: multipart/mixed; boundary="OXfL5xGRrasGEqWY"
>Content-Disposition: inline
>In-Reply-To: <20050316172037.GM793@localhost>
>User-Agent: Mutt/1.4.2.1i
>Sender: vendor-sec-admin@lst.de
>Errors-To: vendor-sec-admin@lst.de
>X-BeenThere: vendor-sec@lst.de
>X-Mailman-Version: 2.0.11
>Precedence: bulk
>List-Help: <mailto:vendor-sec-request@lst.de?subject=help>
>List-Post: <mailto:vendor-sec@lst.de>
>List-Subscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=subscribe>
>List-Id: <vendor-sec.lst.de>
>List-Unsubscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=unsubscribe>
>List-Archive: <https://www.lst.de/cgi-bin/mailman/private/vendor-sec/>
>X-Original-Date: Thu, 17 Mar 2005 17:19:45 +0300
>Date: Thu, 17 Mar 2005 17:19:45 +0300
>X-Virus-Scanned: by amavisd-new at scanhost.suse.de
>X-Spam-Status: No, hits=-3.6 tagged_above=-20.0 required=5.0 tests=BAYES_00,
> MY_LINUX
>X-Spam-Level: 
>Status: RO
>Content-Length: 10347
>Lines: 325
>
>
>--OXfL5xGRrasGEqWY
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: inline
>
>On Wed, Mar 16, 2005 at 10:20:37AM -0700, Tom Rini wrote:
>> Would you mind sharing the fix I assume you've come up with for the
>> Openwall package?  Thanks.
>
>Actually, I wasn't working on this until yesterday.  1 month is way
>too much time for something as trivial as this, and this disclosure
>schedule would have been preventing me from committing the fixes.
>
>Anyway, the patches against OpenBSD 3.0 code are attached.
>
>The bounds checking patch is not perfect (but sufficient).  To make it
>perfect would amount to effectively rewriting this code.
>
>I've only tested the slc_add_reply() part of it, with this "exploit"
>that I came up with:
>
>perl -e 'print "\377", "\372\42\3\377\377\3\3" x 43, "\377\360"' | nc -l 23
>
>This results in 300 bytes written into the 128-byte buffer.  On Owl,
>the effect on the telnet client was that the escape character ('^]')
>stopped working.  Other than that, the client proceeded to work as
>usual.  Indeed, with the patch this effect is gone.
>
>(I'd be interested to know if anyone can actually get a telnet client,
>on whatever system, to crash on the above "exploit".)
>
>I've also improved the environment variable export restrictions such
>that the exportability of DISPLAY and TERM variables may be controlled
>too (tri-state for the TERM), and I've updated the man page.  This
>replaced the Red Hat Linux derived patch that we've been using so far.
>
>Finally, while I was at it, I fixed a possible truncation of DISPLAY.
>
>The RPM package changelog entry is as follows:
>
>* Thu Mar 17 2005 Solar Designer <solar@owl.openwall.com> 3.0-owl2
>- Introduced the appropriate bounds checking into slc_add_reply() and
>env_opt_add() (both are in the telnet client only).
>- Improved the environment variable export restrictions such that the
>exportability of DISPLAY and TERM variables may be controlled too,
>updated the man page; this replaced the Red Hat Linux derived patch.
>- Resolved a possible truncation of DISPLAY when it is sent in response
>to TELOPT_XDISPLOC.
>
>Needless to say, I am not committing this stuff into our public
>repository yet.  I plan, however, to commit all of these patches at
>once on March 28th.  The changes to the environment variable handling
>will not be announced anywhere beyond this package changelog entry
>(although I personally do not think the secrecy around the environment
>variable issue is justified - it has been publicly known for years).
>
>-- 
>/sd
>
>--OXfL5xGRrasGEqWY
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: attachment; filename="telnet-3.0-owl-bound.diff"
>
>diff -urp telnet-3.0.orig/usr.bin/telnet/telnet.c telnet-3.0-bound/usr.bin/telnet/telnet.c
>--- telnet-3.0.orig/usr.bin/telnet/telnet.c	Sat Nov  3 00:07:53 2001
>+++ telnet-3.0-bound/usr.bin/telnet/telnet.c	Thu Mar 17 04:15:47 2005
>@@ -1332,7 +1332,7 @@ slc_check()
> }
> 
> 
>-unsigned char slc_reply[128];
>+unsigned char slc_reply[SUBBUFSIZE * 2];
> unsigned char *slc_replyp;
> 
> 	void
>@@ -1351,6 +1351,8 @@ slc_add_reply(func, flags, value)
> 	unsigned char flags;
> 	cc_t value;
> {
>+	if (slc_replyp > &slc_reply[sizeof(slc_reply) - 6 - 2])
>+		return;
> 	if ((*slc_replyp++ = func) == IAC)
> 		*slc_replyp++ = IAC;
> 	if ((*slc_replyp++ = flags) == IAC)
>@@ -1364,6 +1366,8 @@ slc_end_reply()
> {
>     register int len;
> 
>+    if (slc_replyp > &slc_reply[sizeof(slc_reply) - 2])
>+	return;
>     *slc_replyp++ = IAC;
>     *slc_replyp++ = SE;
>     len = slc_replyp - slc_reply;
>@@ -1483,8 +1487,8 @@ env_opt(buf, len)
> 	}
> }
> 
>-#define	OPT_REPLY_SIZE	256
>-unsigned char *opt_reply;
>+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
>+unsigned char *opt_reply = NULL;
> unsigned char *opt_replyp;
> unsigned char *opt_replyend;
> 
>@@ -1543,11 +1547,14 @@ env_opt_add(ep)
> 		return;
> 	}
> 	vp = env_getvalue(ep);
>-	if (opt_replyp + (vp ? strlen((char *)vp) : 0) +
>-				strlen((char *)ep) + 6 > opt_replyend)
>+	if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
>+				2 * strlen((char *)ep) + 6 > opt_replyend)
> 	{
> 		register int len;
> 		unsigned char *p;
>+		/* XXX: this modifies global variables making them
>+		 * inconsistent with the actual memory allocation for a
>+		 * short moment. */
> 		opt_replyend += OPT_REPLY_SIZE;
> 		len = opt_replyend - opt_reply;
> 		p = (unsigned char *)realloc(opt_reply, len);
>@@ -1573,6 +1580,8 @@ env_opt_add(ep)
> 		*opt_replyp++ = ENV_USERVAR;
> 	for (;;) {
> 		while ((c = *ep++)) {
>+			if (opt_replyp + (2 + 2) > opt_replyend)
>+				return;
> 			switch(c&0xff) {
> 			case IAC:
> 				*opt_replyp++ = IAC;
>@@ -1587,6 +1596,8 @@ env_opt_add(ep)
> 			*opt_replyp++ = c;
> 		}
> 		if ((ep = vp)) {
>+			if (opt_replyp + (1 + 2 + 2) > opt_replyend)
>+				return;
> #ifdef	OLD_ENVIRON
> 			if (telopt_environ == TELOPT_OLD_ENVIRON)
> 				*opt_replyp++ = old_env_value;
>@@ -1618,7 +1629,9 @@ env_opt_end(emptyok)
> {
> 	register int len;
> 
>-	len = opt_replyp - opt_reply + 2;
>+	if (opt_replyp + 2 > opt_replyend)
>+		return;
>+	len = opt_replyp + 2 - opt_reply;
> 	if (emptyok || len > 6) {
> 		*opt_replyp++ = IAC;
> 		*opt_replyp++ = SE;
>
>--OXfL5xGRrasGEqWY
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: attachment; filename="telnet-3.0-owl-env-export.diff"
>
>diff -urp telnet-3.0.orig/usr.bin/telnet/commands.c telnet-3.0-owl-env/usr.bin/telnet/commands.c
>--- telnet-3.0.orig/usr.bin/telnet/commands.c	Mon Sep  3 05:28:51 2001
>+++ telnet-3.0-owl-env/usr.bin/telnet/commands.c	Thu Mar 17 12:44:47 2005
>@@ -1624,7 +1624,10 @@ struct env_lst {
> 	struct env_lst *prev;	/* pointer to previous structure */
> 	unsigned char *var;	/* pointer to variable name */
> 	unsigned char *value;	/* pointer to variable value */
>-	int export;		/* 1 -> export with default list of variables */
>+	int export;		/* whether and how to export this variable: */
>+/* 0: don't permit export */
>+/* 1: export with default list of variables */
>+/* 2: export if explicitly requested by the server only */
> 	int welldefined;	/* A well defined variable */
> };
> 
>@@ -1696,6 +1699,8 @@ env_init()
> 		env_define((unsigned char *)"USER", ep->value);
> 		env_unexport((unsigned char *)"USER");
> 	}
>+	if ((ep = env_find("TERM")))
>+		ep->export = 2;
> 	env_export((unsigned char *)"DISPLAY");
> 	env_export((unsigned char *)"PRINTER");
> 	env_export((unsigned char *)"XAUTHORITY");
>@@ -1801,7 +1806,7 @@ env_list()
> 	register struct env_lst *ep;
> 
> 	for (ep = envlisthead.next; ep; ep = ep->next) {
>-		printf("%c %-20s %s\r\n", ep->export ? '*' : ' ',
>+		printf("%c %-20s %s\r\n", " *+"[ep->export],
> 					ep->var, ep->value);
> 	}
> }
>@@ -1809,6 +1814,7 @@ env_list()
> 	unsigned char *
> env_default(init, welldefined)
> 	int init;
>+	int welldefined;
> {
> 	static struct env_lst *nep = NULL;
> 
>@@ -1818,7 +1824,7 @@ env_default(init, welldefined)
> 	}
> 	if (nep) {
> 		while ((nep = nep->next)) {
>-			if (nep->export && (nep->welldefined == welldefined))
>+			if (nep->export == 1 && nep->welldefined == welldefined)
> 				return(nep->var);
> 		}
> 	}
>@@ -1831,7 +1837,7 @@ env_getvalue(var)
> {
> 	register struct env_lst *ep;
> 
>-	if ((ep = env_find(var)))
>+	if ((ep = env_find(var)) && ep->export)
> 		return(ep->value);
> 	return(NULL);
> }
>diff -urp telnet-3.0.orig/usr.bin/telnet/telnet.1 telnet-3.0-owl-env/usr.bin/telnet/telnet.1
>--- telnet-3.0.orig/usr.bin/telnet/telnet.1	Sat Jun 23 22:14:27 2001
>+++ telnet-3.0-owl-env/usr.bin/telnet/telnet.1	Thu Mar 17 12:57:26 2005
>@@ -436,11 +436,12 @@ command is used to manipulate the
> variables that may be sent through the
> .Dv TELNET ENVIRON
> option.
>-The initial set of variables is taken from the users
>+The initial set of variables is taken from the user's
> environment, with only the
>-.Ev DISPLAY
>+.Ev DISPLAY ,
>+.Ev PRINTER ,
> and
>-.Ev PRINTER
>+.Ev XAUTHORITY
> variables being exported by default.
> The
> .Ev USER
>@@ -449,7 +450,10 @@ variable is also exported if the
> or
> .Fl l
> options are used.
>-.br
>+Additionally, the value of the
>+.Ev TERM
>+variable is by default available to be queried by the server.
>+.Pp
> Valid arguments for the
> .Ic environ
> command are:
>@@ -475,14 +479,16 @@ to be exported to the remote side.
> .It Ic unexport Ar variable
> Mark the variable
> .Ar variable
>-to not be exported unless
>-explicitly asked for by the remote side.
>+to not be exported.
> .It Ic list
> List the current set of environment variables.
> Those marked with a
> .Cm *
> will be sent automatically,
>-other variables will only be sent if explicitly requested.
>+those marked with a
>+.Cm +
>+will only be sent if explicitly requested by the server,
>+and others won't be revealed to the server even if requested.
> .It Ic \&?
> Prints out help information for the
> .Ic environ
>
>--OXfL5xGRrasGEqWY
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: attachment; filename="telnet-3.0-owl-env-DISPLAY.diff"
>
>diff -urp telnet-3.0.orig/usr.bin/telnet/telnet.c telnet-3.0-owl-env/usr.bin/telnet/telnet.c
>--- telnet-3.0.orig/usr.bin/telnet/telnet.c	Sat Nov  3 00:07:53 2001
>+++ telnet-3.0-owl-env/usr.bin/telnet/telnet.c	Thu Mar 17 13:00:57 2005
>@@ -34,6 +34,8 @@
>  * SUCH DAMAGE.
>  */
> 
>+#define _GNU_SOURCE
>+
> #include "telnet_locl.h"
> #include <curses.h>
> #include <term.h>
>@@ -857,10 +859,15 @@ suboption()
> 	if (SB_EOF())
> 	    return;
> 	if (SB_GET() == TELQUAL_SEND) {
>-	    unsigned char temp[50], *dp;
>-	    int len;
>+	    unsigned char *temp, *dp;
>+	    int len = -1;
> 
>-	    if ((dp = env_getvalue((unsigned char *)"DISPLAY")) == NULL) {
>+	    if ((dp = env_getvalue((unsigned char *)"DISPLAY"))) {
>+		len = asprintf((char **)&temp,
>+		    "%c%c%c%c%s%c%c", IAC, SB, TELOPT_XDISPLOC,
>+		    TELQUAL_IS, dp, IAC, SE);
>+	    }
>+	    if (len < 0) {
> 		/*
> 		 * Something happened, we no longer have a DISPLAY
> 		 * variable.  So, turn off the option.
>@@ -868,16 +875,13 @@ suboption()
> 		send_wont(TELOPT_XDISPLOC, 1);
> 		break;
> 	    }
>-	    snprintf((char *)temp, sizeof(temp),
>-		    "%c%c%c%c%s%c%c", IAC, SB, TELOPT_XDISPLOC,
>-		    TELQUAL_IS, dp, IAC, SE);
>-	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
> 
> 	    if (len < NETROOM()) {
> 		ring_supply_data(&netoring, temp, len);
> 		printsub('>', temp+2, len - 2);
> 	    }
> /*@*/	    else printf("lm_will: not enough room in buffer\n");
>+	    free(temp);
> 	}
> 	break;
> 
>
>--OXfL5xGRrasGEqWY--
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>

Actions: View

Attachments on bug 66128: 28649 | 28650 | 28708 | 28709 | 28710 | 28741 | 28742 | 28745 | 28746 | 28756 | 28757 | 32267 | 32268 | 39119