QNX PPPoEd Multiple Local Buffer Overrun Vulnerabilities
BID:11104
Info
QNX PPPoEd Multiple Local Buffer Overrun Vulnerabilities
| Bugtraq ID: | 11104 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 03 2004 12:00AM |
| Updated: | Sep 03 2004 12:00AM |
| Credit: | Discovery of these vulnerabilities are credited to Julio Cesar Fort <[email protected]>. |
| Vulnerable: |
QNX RTOS 6.2 Update Patch A QNX RTOS 6.2 QNX RTOS 6.1 QNX RTOS 2.4 QNX RTOS 4.25 |
| Not Vulnerable: | |
Discussion
QNX PPPoEd Multiple Local Buffer Overrun Vulnerabilities
QNX PPPoEd is reported to be prone to multiple local buffer overflow vulnerabilities. The issues presents themselves when PPPoEd handles certain command line arguments that are greater than 256 bytes in length.
Because variables that are crucial to controlling program execution flow for PPPoEd are stored adjacent to the affected buffers, an attacker may corrupt these values and influence PPPoEd program execution flow into attacker-controlled memory. Ultimately this may lead to the execution of arbitrary instructions in the context of the superuser.
QNX PPPoEd is reported to be prone to multiple local buffer overflow vulnerabilities. The issues presents themselves when PPPoEd handles certain command line arguments that are greater than 256 bytes in length.
Because variables that are crucial to controlling program execution flow for PPPoEd are stored adjacent to the affected buffers, an attacker may corrupt these values and influence PPPoEd program execution flow into attacker-controlled memory. Ultimately this may lead to the execution of arbitrary instructions in the context of the superuser.
Exploit / POC
QNX PPPoEd Multiple Local Buffer Overrun Vulnerabilities
The following example is available:
$ export overflow256='AAAAAAAAAAAAAAA(...)' (around 256 A's)
$ /usr/bin/pppoed -F $overflow256
Memory fault (core dumped)
$ /usr/bin/pppoed service=$overflow256
Memory fault (core dumped)
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
The following example is available:
$ export overflow256='AAAAAAAAAAAAAAA(...)' (around 256 A's)
$ /usr/bin/pppoed -F $overflow256
Memory fault (core dumped)
$ /usr/bin/pppoed service=$overflow256
Memory fault (core dumped)
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
QNX PPPoEd Multiple Local Buffer Overrun Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
QNX PPPoEd Multiple Local Buffer Overrun Vulnerabilities
References:
References:
- QNX Homepage (QNX Software Systems Ltd.)