Libopt.a Error Logging Buffer Overflow Vulnerability
BID:7433
Info
Libopt.a Error Logging Buffer Overflow Vulnerability
| Bugtraq ID: | 7433 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Apr 24 2003 12:00AM |
| Updated: | Apr 24 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to KF <[email protected]>. |
| Vulnerable: |
James Theiler opt 3.18 James Theiler opt 3.17 James Theiler opt 3.16 James Theiler opt 3.13 James Theiler opt 3.12 |
| Not Vulnerable: |
James Theiler opt 3.19 |
Discussion
Libopt.a Error Logging Buffer Overflow Vulnerability
Libopt library has been reported prone to a buffer overflow vulnerability.
It has been reported that several Libopt.a error logging functions, may be prone to buffer overflow vulnerabilities when handling excessive data. The data may be supplied as an argument to a program linked to the vulnerable library. This condition arises from a lack of sufficient bounds checking performed on the user-supplied data, before it is copied into a memory buffer. As a result the bounds of an internal stack-based memory buffer may be overflowed and adjacent memory corrupted with attacker supplied data. It should be noted that no SUID applications linked to this library are currently known.
Although unconfirmed this vulnerability may be exploited to execute arbitrary attacker supplied code.
It should be noted that although this vulnerability was reported to affect Libopt.a version 3.18 previous versions might also be affected.
Libopt library has been reported prone to a buffer overflow vulnerability.
It has been reported that several Libopt.a error logging functions, may be prone to buffer overflow vulnerabilities when handling excessive data. The data may be supplied as an argument to a program linked to the vulnerable library. This condition arises from a lack of sufficient bounds checking performed on the user-supplied data, before it is copied into a memory buffer. As a result the bounds of an internal stack-based memory buffer may be overflowed and adjacent memory corrupted with attacker supplied data. It should be noted that no SUID applications linked to this library are currently known.
Although unconfirmed this vulnerability may be exploited to execute arbitrary attacker supplied code.
It should be noted that although this vulnerability was reported to affect Libopt.a version 3.18 previous versions might also be affected.
Exploit / POC
Libopt.a Error Logging Buffer Overflow Vulnerability
A sample program implementing the opt_atoi() function and a proof of concept exploit have been made available to demonstrate this vulnerability.
A sample program implementing the opt_atoi() function and a proof of concept exploit have been made available to demonstrate this vulnerability.
Solution / Fix
Libopt.a Error Logging Buffer Overflow Vulnerability
Solution:
The vendor has addressed this issue in the current version of the library. Users are advised to relink applications that use libopt.a against the new version of opt:
James Theiler opt 3.12
James Theiler opt 3.13
James Theiler opt 3.16
James Theiler opt 3.17
James Theiler opt 3.18
Solution:
The vendor has addressed this issue in the current version of the library. Users are advised to relink applications that use libopt.a against the new version of opt:
James Theiler opt 3.12
-
James Theiler opt-3.19.tar.gz
http://nis-www.lanl.gov/~jt/Software/opt/opt-3.19.tar.gz
James Theiler opt 3.13
-
James Theiler opt-3.19.tar.gz
http://nis-www.lanl.gov/~jt/Software/opt/opt-3.19.tar.gz
James Theiler opt 3.16
-
James Theiler opt-3.19.tar.gz
http://nis-www.lanl.gov/~jt/Software/opt/opt-3.19.tar.gz
James Theiler opt 3.17
-
James Theiler opt-3.19.tar.gz
http://nis-www.lanl.gov/~jt/Software/opt/opt-3.19.tar.gz
James Theiler opt 3.18
-
James Theiler opt-3.19.tar.gz
http://nis-www.lanl.gov/~jt/Software/opt/opt-3.19.tar.gz
References
Libopt.a Error Logging Buffer Overflow Vulnerability
References:
References:
- opt Homepage (James Theiler)
- SRT2003-04-24-1532 - Options Parsing Tool library buffer overflows. (KF
) - Re: Options Parsing Tool library buffer overflows. (Julien Lanthea
)