OPIE '__opiereadrec()' Off By One Heap Memory Corruption Vulnerability

Bugtraq ID:	40403
Class:	Boundary Condition Error
CVE:	CVE-2010-1938
Remote:	Yes
Local:	Yes
Published:	May 27 2010 12:00AM
Updated:	Jul 22 2011 05:30PM
Credit:	Maksymilian Arciemowicz and Adam 'pi3' Zabrocki
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 amd64 FreeBSD FreeBSD 8.1-PRERELEASE FreeBSD FreeBSD 8.0-STABLE FreeBSD FreeBSD 8.0-RELEASE FreeBSD FreeBSD 7.3-STABLE FreeBSD FreeBSD 7.3-RELEASE-p1 FreeBSD FreeBSD 7.2-STABLE FreeBSD FreeBSD 7.2-RELEASE-p4 FreeBSD FreeBSD 7.2-RELEASE-p1 FreeBSD FreeBSD 7.2-RC2 FreeBSD FreeBSD 7.2-PRERELEASE FreeBSD FreeBSD 7.1-STABLE FreeBSD FreeBSD 7.1-RELEASE-p6 FreeBSD FreeBSD 7.1-RELEASE-p5 FreeBSD FreeBSD 7.1-RELEASE-p4 FreeBSD FreeBSD 7.1 -RELEASE-p2 FreeBSD FreeBSD 7.1 -RELEASE-p1 FreeBSD FreeBSD 7.1 -PRE-RELEASE FreeBSD FreeBSD 6.4-RELENG FreeBSD FreeBSD 6.4-RELEASE-p5 FreeBSD FreeBSD 6.4-RELEASE-p4 FreeBSD FreeBSD 6.4-RELEASE-p2 FreeBSD FreeBSD 6.4 -STABLE FreeBSD FreeBSD 6.4 -RELEASE-p3 FreeBSD FreeBSD 6.4 -RELEASE Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

OPIE '__opiereadrec()' Off By One Heap Memory Corruption Vulnerability

OPIE is prone to an off-by-one memory-corruption vulnerability because it fails to properly bounds-check user-supplied data before copying it into a memory buffer.

Attackers can exploit this issue to crash a vulnerable application using OPIE, resulting in a denial-of-service condition. Attackers may also be able to run arbitrary code within the context of the vulnerable application.

This issue is reported to affect OPIE supplied with FreeBSD 6.x, 7.x, and 8.x; other platforms may also be affected.

OPIE '__opiereadrec()' Off By One Heap Memory Corruption Vulnerability

An attacker may exploit this issue by enticing a victim into connecting to a malicious server.

The following proof-of-concept demonstrating this issue against the ftpd process on FreeBSD is available:

Connected to localhost.
Escape character is '^]'.
220 127.cx FTP server (Version 6.00LS) ready.
user cx
331 Password required for cx.
user AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Connection closed by foreign host.
127#

OPIE '__opiereadrec()' Off By One Heap Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.9.10.1_sparc.deb
  http://ports.ubuntu.com/pool/main/o/opie/libopie-dev_2.40~dfsg-0ubuntu 1.9.10.1_sparc.deb


• Ubuntu libpam-opie_0.21-8build2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libp/libpam-opie/libpam-opie_0.21-8b uild2.1_sparc.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.9.10.1_sparc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-client_2.40~dfsg-0ubuntu 1.9.10.1_sparc.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.9.10.1_sparc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-server_2.40~dfsg-0ubuntu 1.9.10.1_sparc.deb

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.9.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/opie/libopie-dev_2.40~dfsg-0ubuntu 1.9.10.1_powerpc.deb


• Ubuntu libpam-opie_0.21-8build2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libp/libpam-opie/libpam-opie_0.21-8b uild2.1_powerpc.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.9.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-client_2.40~dfsg-0ubuntu 1.9.10.1_powerpc.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.9.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-server_2.40~dfsg-0ubuntu 1.9.10.1_powerpc.deb

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.9.10.1_lpia.deb
  http://ports.ubuntu.com/pool/main/o/opie/libopie-dev_2.40~dfsg-0ubuntu 1.9.10.1_lpia.deb


• Ubuntu libpam-opie_0.21-8build2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libp/libpam-opie/libpam-opie_0.21-8b uild2.1_lpia.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.9.10.1_lpia.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-client_2.40~dfsg-0ubuntu 1.9.10.1_lpia.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.9.10.1_lpia.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-server_2.40~dfsg-0ubuntu 1.9.10.1_lpia.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.9.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/o/opie/libopie-dev_2.40~dfsg-0ubuntu 1.9.04.1_sparc.deb


• Ubuntu libpam-opie_0.21-8build1.9.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libp/libpam-opie/libpam-opie_0.21-8b uild1.9.04.1_sparc.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.9.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-client_2.40~dfsg-0ubuntu 1.9.04.1_sparc.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.9.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-server_2.40~dfsg-0ubuntu 1.9.04.1_sparc.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.9.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/opie/libopie-dev_2.40~dfsg-0ubuntu 1.9.04.1_powerpc.deb


• Ubuntu libpam-opie_0.21-8build1.9.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libp/libpam-opie/libpam-opie_0.21-8b uild1.9.04.1_powerpc.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.9.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-client_2.40~dfsg-0ubuntu 1.9.04.1_powerpc.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.9.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-server_2.40~dfsg-0ubuntu 1.9.04.1_powerpc.deb

Ubuntu Ubuntu Linux 10.04 powerpc

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.10.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/opie/libopie-dev_2.40~dfsg-0ubuntu 1.10.04.1_powerpc.deb


• Ubuntu libpam-opie_0.21-8build3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libp/libpam-opie/libpam-opie_0.21-8b uild3.1_powerpc.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.10.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-client_2.40~dfsg-0ubuntu 1.10.04.1_powerpc.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.10.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-server_2.40~dfsg-0ubuntu 1.10.04.1_powerpc.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.9.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/libopie-dev_2.40~df sg-0ubuntu1.9.04.1_i386.deb


• Ubuntu libpam-opie_0.21-8build1.9.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-opie/libpam-op ie_0.21-8build1.9.04.1_i386.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.9.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-client_2.40~df sg-0ubuntu1.9.04.1_i386.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.9.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-server_2.40~df sg-0ubuntu1.9.04.1_i386.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.9.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/o/opie/libopie-dev_2.40~dfsg-0ubuntu 1.9.04.1_lpia.deb


• Ubuntu libpam-opie_0.21-8build1.9.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libp/libpam-opie/libpam-opie_0.21-8b uild1.9.04.1_lpia.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.9.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-client_2.40~dfsg-0ubuntu 1.9.04.1_lpia.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.9.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-server_2.40~dfsg-0ubuntu 1.9.04.1_lpia.deb

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.9.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/libopie-dev_2.40~df sg-0ubuntu1.9.10.1_i386.deb


• Ubuntu libpam-opie_0.21-8build2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-opie/libpam-op ie_0.21-8build2.1_i386.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.9.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-client_2.40~df sg-0ubuntu1.9.10.1_i386.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.9.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-server_2.40~df sg-0ubuntu1.9.10.1_i386.deb

Ubuntu Ubuntu Linux 10.04 amd64

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.10.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/libopie-dev_2.40~df sg-0ubuntu1.10.04.1_amd64.deb


• Ubuntu libpam-opie_0.21-8build3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-opie/libpam-op ie_0.21-8build3.1_amd64.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.10.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-client_2.40~df sg-0ubuntu1.10.04.1_amd64.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.10.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-server_2.40~df sg-0ubuntu1.10.04.1_amd64.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.9.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/libopie-dev_2.40~df sg-0ubuntu1.9.10.1_amd64.deb


• Ubuntu libpam-opie_0.21-8build2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-opie/libpam-op ie_0.21-8build2.1_amd64.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.9.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-client_2.40~df sg-0ubuntu1.9.10.1_amd64.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.9.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-server_2.40~df sg-0ubuntu1.9.10.1_amd64.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.9.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/libopie-dev_2.40~df sg-0ubuntu1.9.04.1_amd64.deb


• Ubuntu libpam-opie_0.21-8build1.9.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-opie/libpam-op ie_0.21-8build1.9.04.1_amd64.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.9.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-client_2.40~df sg-0ubuntu1.9.04.1_amd64.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.9.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-server_2.40~df sg-0ubuntu1.9.04.1_amd64.deb

Ubuntu Ubuntu Linux 10.04 sparc

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.10.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/o/opie/libopie-dev_2.40~dfsg-0ubuntu 1.10.04.1_sparc.deb


• Ubuntu libpam-opie_0.21-8build3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libp/libpam-opie/libpam-opie_0.21-8b uild3.1_sparc.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.10.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-client_2.40~dfsg-0ubuntu 1.10.04.1_sparc.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.10.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/o/opie/opie-server_2.40~dfsg-0ubuntu 1.10.04.1_sparc.deb

Ubuntu Ubuntu Linux 10.04 i386

• Ubuntu libopie-dev_2.40~dfsg-0ubuntu1.10.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/libopie-dev_2.40~df sg-0ubuntu1.10.04.1_i386.deb


• Ubuntu libpam-opie_0.21-8build3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-opie/libpam-op ie_0.21-8build3.1_i386.deb


• Ubuntu opie-client_2.40~dfsg-0ubuntu1.10.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-client_2.40~df sg-0ubuntu1.10.04.1_i386.deb


• Ubuntu opie-server_2.40~dfsg-0ubuntu1.10.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/o/opie/opie-server_2.40~df sg-0ubuntu1.10.04.1_i386.deb

OPIE '__opiereadrec()' Off By One Heap Memory Corruption Vulnerability

References:

• FreeBSD Homepage (FreeBSD)
  
• libopie __readrec() off-by one (FreeBSD ftpd remote PoC) (SecurityReason)