Nmap logo

Overflows in libxview

Description:Standard environmental variable buffer overflows
Author:Nicolas Dubee <dube0866@EUROBRETAGNE.FR>
Compromise: root (local)
Vulnerable Systems:Those running X11 and xview 3.2p1.4, all older 3.x varified, probably earlier ones vulnerable.
Date:10 July 1997

Date: Sat, 1 Jan 1994 06:28:53 +0100
From: Nicolas Dubee <dube0866@EUROBRETAGNE.FR>

                   plaguez security advisory n. 6

                     libxview buffer overflows

Program:  libxview
          the XView toolkit library, an OpenLook user
          interface development toolkit.

Version:  current (3.2p1.4)
          surely older ones (3.x verified).

OS:       any OS running X11 and xview.

Problem:  buffer overflows.

Impact:   any setuid program using xview is vulnerable
          and can be used to execute arbitrary
          commands as the owner of the program.


guess what ! Yet another buffer overflow. This one is
in the xview library. Well, I should say buffer
overflowS because there are several overflows in the
Most of them happen while getting and environment
variable and copying it into a fixed-length buffer.
I included in this post the summary of the overflows
i found.

Note that there may be others as well.

Affected functions:

------------------ dflts_put.c
static void node_write(path_name, file_name, status, flag)

------------------ font.c
static Font_locale_info *find_font_locale_info(server, avlist)

------------------  wckind.c
void _wckind_init()

------------------ server.c
Pkg_private int server_init(parent, server_public, avlist)
static void server_setlocale_to_default(server)
static void server_init_atoms(server_public)

------------------ txt_e_menu.c
Pkg_private char * textsw_get_extras_filename(mi)

------------------ tty_map_key.c
Pkg_private void ttysw_readrc(ttysw)

I included this list of vulnerabilities since I'm too lazy
and don't have time to make a patch.

For the exploits, well, eh, spot a setuid root xview program
and implement a standart buffer overflow with any affected
environment variable:

that's all folks,


   plaguez / libpcap
ps: if you have a box at the end of a line
and would like to see www.plaguez.org instead
of xxx.xxx.xxx, please mail me ! :)

More Exploits!

The master index of all exploits is available here (Very large file)
Or you can pick your favorite operating system:
All OS's Linux Solaris/SunOS Micro$oft
*BSD Macintosh AIX IRIX
ULTRIX/Digital UNIX HP/UX SCO Remote exploits

This page is part of Fyodor's exploit world. For a free program to automate scanning your network for vulnerable hosts and services, check out my network mapping tool, nmap. Or try these Insecure.Org resouces:

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]