[14077] in bugtraq
[ Hackerslab bug_paper ] Linux dump buffer overflow
daemon@ATHENA.MIT.EDU (1h?kAX KimYongJun (99A9>w))
Tue Feb 29 19:11:09 2000
Message-Id: <200002280617.PAA13373@ce.hannam.ac.kr>
Date: Mon, 28 Feb 2000 15:17:33 +0900
Reply-To: "1h?kAX KimYongJun (99A9>w)" <s96192@CE.HANNAM.AC.KR>
From: "1h?kAX KimYongJun (99A9>w)" <s96192@CE.HANNAM.AC.KR>
X-To: BUGTRAQ@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
[ Hackerslab bug_paper ] Linux dump buffer overflow
File : /sbin/dump
SYSTEM : Linux
INFO :
The problem occurs when it gets the argument.
It accepts the argument without checking out its length, and this causes the problem.
It seems that this vulnerability also applies to RedHat Linux 6.2beta,
the latest version.
[loveyou@loveyou SOURCES]$ dump -f a `perl -e 'print "x" x 556'`
DUMP: Date of this level 0 dump: Mon Feb 28 14:45:01 2000
DUMP: Date of last level dump: the epoch
DUMP: Dumping xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx to a
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: FD@O @L8'@L 3J9+ 1i4O4Y while opening filesystem
DUMP: SIGSEGV: ABORTING!
Segmentation fault
[loveyou@loveyou SOURCES]$ dump -f a `perl -e 'print "loveyou" x 556'`
DUMP: SIGSEGV: ABORTING!
Segmentation fault <= occur ctime4()
How to fix
----------
patch :
[root@loveyou SOURCES]# diff -ru dump-0.4b13/dump/main_orig.c dump-0.4b13/dump/main.c
--- dump-0.4b13/dump/main_orig.c Mon Feb 28 14:40:01 2000
+++ dump-0.4b13/dump/main.c Mon Feb 28 14:40:57 2000
@@ -273,6 +273,9 @@
exit(X_STARTUP);
}
disk = *argv++;
+ if ( strlen(disk) > 255 )
+ exit(X_STARTUP);
+
argc--;
if (argc >= 1) {
(void)fprintf(stderr, "Unknown arguments to dump:");
hot fix :
it is recommended that the suid bit is
removed from dump using command :
chmod a-s /sbin/dump
- Yong-jun, Kim -
e - mail : loveyou@hackerslab.org s96192@ce.hannam.ac.kr
homepage : http://www.hackerslab.org http://ce.hannam.ac.kr/~s96192
