Tolis Group BRU Improper Command-line Parsing Vulnerability

Bugtraq ID:	8215
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Jul 16 2003 12:00AM
Updated:	Jul 16 2003 12:00AM
Credit:	Reported by KF <[email protected]>.
Vulnerable:	Tolis Group BRU 17.0
Not Vulnerable:

Tolis Group BRU Improper Command-line Parsing Vulnerability

It has been reported that BRU may not properly parse commandline arguments, potentially leading to at least two vectors of exploitation. It may be possible for local attackers to conduct format string-based attacks as well as buffer overflow-based attacks.

It should be noted that although BRU does not ship with the suid bit set by default, documentation within the software may instruct users to enable it.

Tolis Group BRU Improper Command-line Parsing Vulnerability

The following proof-of-concept has been provided:

elguapo@gentoo elguapo $ /bru/bru `perl -e 'print "A" x 3050'`
bru: [E155] error - memory fault (SIGSEGV)

elguapo@gentoo elguapo $ /bru/bru %n%n%n%n
bru: [E155] error - memory fault (SIGSEGV)

The following exploit is available:

• /data/vulnerabilities/exploits/ex_bru.c
• /data/vulnerabilities/exploits/0x333bru-fmtx.c

Tolis Group BRU Improper Command-line Parsing Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Tolis Group BRU Improper Command-line Parsing Vulnerability

References:

• 0x333bru-fmtx.c (0x333.org)
  
• Tolis Group Homepage (Tolis Group)