[34513] in bugtraq
Gnome nautilus bug
daemon@ATHENA.MIT.EDU (gsicht gsicht)
Mon Apr 12 18:23:16 2004
Date: 12 Apr 2004 13:49:07 -0000
Message-ID: <20040412134907.7099.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: gsicht gsicht <nothing.king@firemail.de>
To: bugtraq@securityfocus.com
Application: Gnome nautilus
Versions: 2.2.1 and others
Bug: Buffer Overflow
Exploitation: unknown
Date: 12.04.04
Author: gsicht
e-mail: nothing.king@firemail.de
#####################
# the bug: #
#####################
i discovered a buffer overflow vulnerability in gnome nautilus.
i don't know many details about this overflow, but if someone is possible to create a directory with a name of 255 x A,
nautilus won't be able to handle with the directory. The creating of the directory could be possible through a ftp server.
example:
http://www.k-otik.com/exploits/08.11.0x82-wu262-advanced.c
if you delete your directory(not in a shell), you can find it in your trash. now clear it, and you'll get an error with a segmentation fault.
if you enter the directory in your trash with a double click and also do this with the next directory, you'll get a segmentation fault, too.
