Richard Everitt Pileup Buffer Overflow Vulnerability
BID:3086
Info
Richard Everitt Pileup Buffer Overflow Vulnerability
| Bugtraq ID: | 3086 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2001-0989 |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 22 2001 12:00AM |
| Updated: | Jul 11 2009 06:56AM |
| Credit: | Patch and report submitted to bugtraq by Joop Stakenborg <[email protected]> on July 22, 2001. |
| Vulnerable: |
Richard Everitt Pileup 1.1 |
| Not Vulnerable: |
Richard Everitt Pileup 1.2 |
Discussion
Richard Everitt Pileup Buffer Overflow Vulnerability
Pileup is a Linux morse code simulator for amateur radio operators which uses SoundBlaster hardware.
Pileup version 1.1 has been found to contain two buffer overflow vulnerabilities due to insecurely structured calls to 'scanf', in which strings of arbitrary length are copied into local variables without sufficient bounds checking.
If the length of either string, read from standard input, exceeds the size of its input buffer, the excess data will overwrite other variables on the stack and the stack frame itself.
As a result, since the program is installed suid root, an attacker can replace the affected function's return address with a pointer to malicious shellcode, allowing arbitrary code to run with root privilege.
Pileup is a Linux morse code simulator for amateur radio operators which uses SoundBlaster hardware.
Pileup version 1.1 has been found to contain two buffer overflow vulnerabilities due to insecurely structured calls to 'scanf', in which strings of arbitrary length are copied into local variables without sufficient bounds checking.
If the length of either string, read from standard input, exceeds the size of its input buffer, the excess data will overwrite other variables on the stack and the stack frame itself.
As a result, since the program is installed suid root, an attacker can replace the affected function's return address with a pointer to malicious shellcode, allowing arbitrary code to run with root privilege.
References
Richard Everitt Pileup Buffer Overflow Vulnerability
References:
References:
- Pileup program site (Richard Everitt)