From: advisories(-at-)texonet.com (advisoriestexonet.com)
Date: Mon Oct 27 2003 - 14:33:47 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

-----------------------------------------------------------------------
Texonet Security Advisory 20030908
-----------------------------------------------------------------------
Advisory ID : TEXONET-20030908
Authors : Joel Soderberg and Christer Oberg
Issue date : Monday, September 8, 2003
Publish date : Monday, October 27, 2003
Application : thttpd
Version(s) : 2.21 - 2.23b1
Platforms : FreeBSD, SunOS 4, Solaris 2, BSD/OS, Linux, OSF
Availability : http://www.texonet.com/advisories/TEXONET-20030908.txt
-----------------------------------------------------------------------

Problem:
-----------------------------------------------------------------------
Remote overflow allows attacker to partially overwrite ebp register and
execute arbitrary code.

Description:
-----------------------------------------------------------------------
The problem is found in libhttpd.c in the function defang()

static void
defang( char* str, char* dfstr, int dfsize )
    {
    char* cp1;
    char* cp2;

    for ( cp1 = str, cp2 = dfstr;
   *cp1 != '\0' && cp2 - dfstr < dfsize - 1;
   ++cp1, ++cp2 )
 {
 switch ( *cp1 )
     {
     case '<':
     *cp2++ = '&';
     *cp2++ = 'l';
     *cp2++ = 't';
     *cp2 = ';';
     break;
     case '>':
     *cp2++ = '&';
     *cp2++ = 'g';
     *cp2++ = 't';
     *cp2 = ';';
     break;
     default:
     *cp2 = *cp1;
     break;
     }
 }
    *cp2 = '\0';
    }

So when '<' or '>' are found in the input we "pay for 1 and get 3 for
free", this allows us overwrite bits of ebp and indirectly control eip
(assuming its been compiled with gcc < 3.0)

Workaround:
-----------------------------------------------------------------------
Upgrade to version 2.24

Disclosure Timeline:
-----------------------------------------------------------------------
09/08/2003: Vendor notified by e-mail
09/12/2003: Vendor replies with working fix
10/27/2003: Public release

About Texonet:
-----------------------------------------------------------------------
Texonet is a Swedish based security company with a focus on penetration
testing / security assessments, research and development.

Contacting Texonet:
-----------------------------------------------------------------------
E-mail: advisories(-at-)texonet.com
Homepage: http://www.texonet.com/
Phone: +46-8-55174611

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]