Overflows in libxview

Summary
Description:Standard environmental variable buffer overflows
Author:Nicolas Dubee <dube0866@EUROBRETAGNE.FR>
Compromise: root (local)
Vulnerable Systems:Those running X11 and xview 3.2p1.4, all older 3.x varified, probably earlier ones vulnerable.
Date:10 July 1997
Details


Date: Sat, 1 Jan 1994 06:28:53 +0100
From: Nicolas Dubee <dube0866@EUROBRETAGNE.FR>
To: BUGTRAQ@NETSPACE.ORG

                   plaguez security advisory n. 6

                     libxview buffer overflows




Program:  libxview
          the XView toolkit library, an OpenLook user
          interface development toolkit.

Version:  current (3.2p1.4)
          surely older ones (3.x verified).

OS:       any OS running X11 and xview.

Problem:  buffer overflows.

Impact:   any setuid program using xview is vulnerable
          and can be used to execute arbitrary
          commands as the owner of the program.



hello,

guess what ! Yet another buffer overflow. This one is
in the xview library. Well, I should say buffer
overflowS because there are several overflows in the
code.
Most of them happen while getting and environment
variable and copying it into a fixed-length buffer.
I included in this post the summary of the overflows
i found.

Note that there may be others as well.


Affected functions:

------------------ dflts_put.c
static void node_write(path_name, file_name, status, flag)

------------------ font.c
static Font_locale_info *find_font_locale_info(server, avlist)

------------------  wckind.c
void _wckind_init()

------------------ server.c
Pkg_private int server_init(parent, server_public, avlist)
static void server_setlocale_to_default(server)
static void server_init_atoms(server_public)

------------------ txt_e_menu.c
Pkg_private char * textsw_get_extras_filename(mi)

------------------ tty_map_key.c
Pkg_private void ttysw_readrc(ttysw)




I included this list of vulnerabilities since I'm too lazy
and don't have time to make a patch.

For the exploits, well, eh, spot a setuid root xview program
and implement a standart buffer overflow with any affected
environment variable:
DEFAULT_FILES, OPENWINHOME, HOME, XVIEW_DEFAULT_LOCALE,
PROMPT,



that's all folks,

plaguez
dube0866@eurobretagne.fr




------------------------
   plaguez / libpcap
dube0866@eurobretagne.fr
  http://xxx.xxx.xxx
------------------------
ps: if you have a box at the end of a line
and would like to see www.plaguez.org instead
of xxx.xxx.xxx, please mail me ! :)

More Exploits!

The master index of all exploits is available here (Very large file)
Or you can pick your favorite operating system:
All OS's Linux Solaris/SunOS Micro$oft
*BSD Macintosh AIX IRIX
ULTRIX/Digital UNIX HP/UX SCO Remote exploits

This page is part of Fyodor's exploit world. For a free program to automate scanning your network for vulnerable hosts and services, check out my network mapping tool, nmap. Or try these Insecure.Org resouces:

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault