[Full-disclosure] Vulnerability in Linux Kiss Server v1.2

[David Judais]

Sorry, my response became detached from the original thread somehow.

On Wed, Mar 5, 2008 at 4:29 PM, David Judais <david.judais at googlemail.com>
wrote:

> Why isn't there a patch?
>
> > From: vashnukad at vashnukad.com
> >
> Site: http://www.vashnukad.com
>
> Application: Linux Kiss Server v1.2
>
> Type: Format strings
>
> Priority: Medium
>
> Patch available: No
>
>
> The Linux Kiss Server contains a format strings vulnerability that, if run
> in foreground mode, can be leveraged for access. The vulnerability is
> demonstrated in the code below:
>
>             Function log_message():
>
>                   if(background_mode == 0)
>
>                   {
>
>                     if(type == 'l')
>
>                       fprintf(stdout,log_msg);
>
>
>                     if(type == 'e')
>
>                       fprintf(stderr,log_msg);
>
>                     free(log_msg);
>
>                   }
>
>
>
>
>             Function kiss_parse_cmd():
>
>
>
>                   /* check full command name */
>
>                   if (strncmp(cmd, buf, cmd_len))
>
>                       {
>
>                          asprintf(&log_msg,"unknow command: `%s'", buf);
>
>                          log_message(log_msg,'e');
>
>                          goto error;
>
>                       }
>
>                   buf += cmd_len;
>
>
>
> So putting something like %n%n%n in 'buf' you can trigger the
> vulnerability.
>
>
> --
>
> Name: Vashnukad
>
> E-mail: vashnukad at vashnukad.com
>
> Site: http://www.vashnukad.com
>
>
>
>
> --
>
> Name: Vashnukad
>
> e-mail: vashnukad at vashnukad.com
>
> Site: http://www.vashnukad.com
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20080307/2df8c068/attachment.html