Overflows in libxview

Date: Sat, 1 Jan 1994 06:28:53 +0100
From: Nicolas Dubee <dube0866@EUROBRETAGNE.FR>
To: BUGTRAQ@NETSPACE.ORG

                   plaguez security advisory n. 6

                     libxview buffer overflows




Program:  libxview
          the XView toolkit library, an OpenLook user
          interface development toolkit.

Version:  current (3.2p1.4)
          surely older ones (3.x verified).

OS:       any OS running X11 and xview.

Problem:  buffer overflows.

Impact:   any setuid program using xview is vulnerable
          and can be used to execute arbitrary
          commands as the owner of the program.



hello,

guess what ! Yet another buffer overflow. This one is
in the xview library. Well, I should say buffer
overflowS because there are several overflows in the
code.
Most of them happen while getting and environment
variable and copying it into a fixed-length buffer.
I included in this post the summary of the overflows
i found.

Note that there may be others as well.


Affected functions:

------------------ dflts_put.c
static void node_write(path_name, file_name, status, flag)

------------------ font.c
static Font_locale_info *find_font_locale_info(server, avlist)

------------------  wckind.c
void _wckind_init()

------------------ server.c
Pkg_private int server_init(parent, server_public, avlist)
static void server_setlocale_to_default(server)
static void server_init_atoms(server_public)

------------------ txt_e_menu.c
Pkg_private char * textsw_get_extras_filename(mi)

------------------ tty_map_key.c
Pkg_private void ttysw_readrc(ttysw)




I included this list of vulnerabilities since I'm too lazy
and don't have time to make a patch.

For the exploits, well, eh, spot a setuid root xview program
and implement a standart buffer overflow with any affected
environment variable:
DEFAULT_FILES, OPENWINHOME, HOME, XVIEW_DEFAULT_LOCALE,
PROMPT,



that's all folks,

plaguez
dube0866@eurobretagne.fr




------------------------
   plaguez / libpcap
dube0866@eurobretagne.fr
  http://xxx.xxx.xxx
------------------------
ps: if you have a box at the end of a line
and would like to see www.plaguez.org instead
of xxx.xxx.xxx, please mail me ! :)