BNC sbuf_getmsg() Buffer Overflow Vulnerability
BID:11355
Info
BNC sbuf_getmsg() Buffer Overflow Vulnerability
| Bugtraq ID: | 11355 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 09 2004 12:00AM |
| Updated: | Oct 09 2004 12:00AM |
| Credit: | Discovery credited to "Yak". |
| Vulnerable: |
BNC BNC 2.8.8 BNC BNC 2.6.2 BNC BNC 2.6 BNC BNC 2.4.8 BNC BNC 2.4.6 BNC BNC 2.2.4 |
| Not Vulnerable: |
BNC BNC 2.8.9 |
Discussion
BNC sbuf_getmsg() Buffer Overflow Vulnerability
A boundary condition error in BNC that is potentially a vulnerability has been discovered and corrected. The overflow occurs in procedure sbuf_getmsg(). Prior to version 2.8.9, BNC attempted to support "backspace" byte values found in the raw network data by using a pointer decrement to "erase" the previous byte of the destination buffer in a copy loop. This was done without checks to ensure that the pointer to the destination buffer did not point to a location beyond the boundary of the destination buffer space. This has created a potential buffer overflow condition that can be triggered remotely by untrusted data. The data would likely come from an IRC server.
The overflow occurs in the BSS region, exploitability has not been confirmed.
A boundary condition error in BNC that is potentially a vulnerability has been discovered and corrected. The overflow occurs in procedure sbuf_getmsg(). Prior to version 2.8.9, BNC attempted to support "backspace" byte values found in the raw network data by using a pointer decrement to "erase" the previous byte of the destination buffer in a copy loop. This was done without checks to ensure that the pointer to the destination buffer did not point to a location beyond the boundary of the destination buffer space. This has created a potential buffer overflow condition that can be triggered remotely by untrusted data. The data would likely come from an IRC server.
The overflow occurs in the BSS region, exploitability has not been confirmed.
Exploit / POC
BNC sbuf_getmsg() Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
BNC sbuf_getmsg() Buffer Overflow Vulnerability
Solution:
Gentoo has released advisory GLSA 200410-13 to address this issue. Updates may be applied with the following commands as the superuser:
emerge sync
emerge -pv ">=net-irc/bnc-2.8.9"
emerge ">=net-irc/bnc-2.8.9"
The code responsible for the flaw was removed in version 2.8.9.
BNC BNC 2.8.8
Solution:
Gentoo has released advisory GLSA 200410-13 to address this issue. Updates may be applied with the following commands as the superuser:
emerge sync
emerge -pv ">=net-irc/bnc-2.8.9"
emerge ">=net-irc/bnc-2.8.9"
The code responsible for the flaw was removed in version 2.8.9.
BNC BNC 2.8.8
-
BNC bnc2.8.9.tar.gz
http://www.gotbnc.com/files/bnc2.8.9.tar.gz
References
BNC sbuf_getmsg() Buffer Overflow Vulnerability
References:
References:
- BNC Home Page (BNC)
- Changelog for 2.8.9 (BNC)