Socks5 1.0r5 Buffer Overflow Vulnerability

Bugtraq ID:	154
Class:	Boundary Condition Error
CVE:	CVE-1999-1435
Remote:	Yes
Local:	Yes
Published:	Jul 10 1998 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	This vulnerability was discovered, and reported to the Bugtraq mailing list by Zach Brown <[email protected]> on July 10, 1998.
Vulnerable:	NEC socks5 1.0 r5
Not Vulnerable:

Socks5 1.0r5 Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Socks5 1.0r5 Buffer Overflow Vulnerability

Solution:
Version 1.0r6 fixes this problem by replacing the call to vsprintf() with vsnprintf() and bounding the fill to the size of the fmt_cpy variable it is filling. This version, and subsequent version, are available at http://www.socks.nec.com/.

As a temporary fix, the following patch can be applied:

diff -r -u socks-dist/lib/log.c socks5-v1.0r5/lib/log.c
--- socks-dist/lib/log.c Thu Feb 19 10:49:56 1998
+++ socks5-v1.0r5/lib/log.c Wed Jul 1 16:39:30 1998
@@ -77,7 +77,8 @@
}

void S5LogvUpdate(const void *handle, int level, int msgID, const char *oformat, va_list pvar) {
- char fmt_cpy[2*1024 + 2*10], format[2*1024 + 2*10];
+#define FMT_BUFLEN (2*1024 + 2*10)
+ char fmt_cpy[FMT_BUFLEN], format[FMT_BUFLEN];
S5LogHandle *h = (S5LogHandle *)handle;
int serrno = GETERRNO();
static int dontLoop = 0;
@@ -112,7 +113,9 @@
strcat(format, " ");

replacePercentM(oformat, format + strlen(format), sizeof(format) - strlen(format));
- vsprintf(fmt_cpy, format, pvar);
+ if(vsnprintf(fmt_cpy, FMT_BUFLEN-1,format, pvar)==-1) {
+ fmt_cpy[FMT_BUFLEN-1]='\0';
+ }

/* Log to the Local log facility, e.g. Stderr on Unix and maybe a window */
/* or something on NT. Neither system can deal with a NULL format so */

Socks5 1.0r5 Buffer Overflow Vulnerability

References: