LTrace Local Command Line Parameter Heap Overflow Vulnerability
BID:8790
Info
LTrace Local Command Line Parameter Heap Overflow Vulnerability
| Bugtraq ID: | 8790 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-0172 |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 07 2003 12:00AM |
| Updated: | Jul 11 2009 11:56PM |
| Credit: | Discovery is credited to "Abhisek Datta" <[email protected]>. |
| Vulnerable: |
Juan Cespedes ltrace 0.3.10 |
| Not Vulnerable: | |
Discussion
LTrace Local Command Line Parameter Heap Overflow Vulnerability
ltrace has been reported prone to a heap buffer overflow vulnerability when handling command line arguments of excessive size. The issue is reported to present itself when ltrace handles command line arguments upward of 6000 bytes. The issue is likely due to a lack of sufficient boundary checks performed on command line arguments before they are copied into a reserved buffer in heap-based memory.
A local attacker may potentially exploit this condition to corrupt malloc chunk headers that are adjacent to the vulnerable buffer. Although unconfirmed, the attacker may leverage this condition to have arbitrary instructions executed with the privileges of ltrace. ltrace may be theoretically be installed setuid on some systems.
ltrace has been reported prone to a heap buffer overflow vulnerability when handling command line arguments of excessive size. The issue is reported to present itself when ltrace handles command line arguments upward of 6000 bytes. The issue is likely due to a lack of sufficient boundary checks performed on command line arguments before they are copied into a reserved buffer in heap-based memory.
A local attacker may potentially exploit this condition to corrupt malloc chunk headers that are adjacent to the vulnerable buffer. Although unconfirmed, the attacker may leverage this condition to have arbitrary instructions executed with the privileges of ltrace. ltrace may be theoretically be installed setuid on some systems.
Exploit / POC
LTrace Local Command Line Parameter Heap Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
LTrace Local Command Line Parameter Heap Overflow Vulnerability
Solution:
The issue is reportedly addressed in ltrace 0.3.30. This has not been confirmed by Symantec.
---
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
The issue is reportedly addressed in ltrace 0.3.30. This has not been confirmed by Symantec.
---
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
LTrace Local Command Line Parameter Heap Overflow Vulnerability
References:
References:
- ltrace Homepage (ltrace)