[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    RE: Ethereal remote buffer overflow - addon
From:       LSS Security <exposed () lss ! hr>
Date:       2005-03-09 1:33:58
Message-ID: 20050309013358.GA27033 () cecilija ! zesoi ! fer ! hr
[Download RAW message or body]


Just a little trick to overflow more stack memory in Ethereal.
It is possible to overflow stack with more than 255 - 2 bytes. If radius_len 
is set to 1, in strncpy() line it is subtracted by two and it will be -1 
(0xffffffff -> 4294967295 (unsigned long)).  

packet-3g-a11.c:
----------------
#define MAX_STRVAL 16
...
dissect_a11_radius( tvbuff_t *tvb, int offset, proto_tree *tree, int app_len)
{
...
  size_t     radius_len;
  ...
  guchar     str_val[MAX_STRVAL]; 
  ...
  radius_len = tvb_get_guint8(tvb, offset + 1);
  ...
  strncpy(str_val, tvb_get_ptr(tvb,offset+2,radius_len-2), radius_len-2); 
...
}
----------------


------------------------------------------
Leon Juranic, LSS Security
http://security.lss.hr

"Born under the lucky star magical,
but on this world generally tragical".
                                - Djole

[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic