Overflow in cgiwrap-3.5 and 3.6beta1

Date: Sun, 7 Dec 1997 00:23:15 GMT
From: Duncan Simpson <dps@IO.STARGATE.CO.UK>
To: BUGTRAQ@NETSPACE.ORG
Subject: cgiwrap-3.5 (and 3.6beta1,              avialiblty of which is not known) buffer overrun

Hi, I have been hacking cgiwrap-3.5 for my own purposes. Anyway I spotted
a code fragmen that allocated a static buffer and printed an arbitary
lenght string in it. Exploits probably require one to create a file with
the name contiaining shellcode but that should not be a serious problem (/
means new dir and \0 does not happen).

Here is a patch:
diff -ur cgiwrap-3.6beta1/util.c cgiwrap-3.6beta1-fixed/util.c
--- cgiwrap-3.6beta1/util.c     Tue Nov 18 04:51:05 1997
+++ cgiwrap-3.6beta1-fixed/util.c       Sun Dec  7 00:15:27 1997
@@ -282,7 +282,7 @@

        if (!(fileStat.st_mode & S_IXUSR))
        {
-               sprintf(tempErrString, "Script is not executable. Issue chmod 755 %s", scriptPath);
+               snprintf(tempErrString, 254, "Script is not executable. Issue chmod 755 %s", scriptPath);
                MSG_Error_ExecutionNotPermitted(tempErrString);
        }

which should apply cleaning to 3.5 as well. (The patch is against 3.6beta1
as you can see). The maintainer has been informed.

Duncan (-: