Subject: RE: SIGVEC popen()

From: "Roger A. Hanke" <[email-masked]>
Date: Wed, 28 May 1997 13:20:14 -0400

Alain,
 I confirmed this occurs on the Beta 11 version I am running. Sounds as if
it was also confirmed on the latest Beta 13 version. So has this at least been
submitted to Stan this time so it can be included in a future distribution?
	Roger Hanke

----------
From: 	Alain Magloire[SMTP:[email-masked]]
Sent: 	Tuesday, May 27, 1997 2:23 PM
To: 	[email-masked]
Subject: 	SIGVEC popen()

This is an old bug
  about popen.c(ftpd_popen() once again). It was reported before
but I did not see any patch for it. I don't know if it's exploitable
on the non-beta releases of wu-ftpd or other ftp servers. To see
if you are affected just telnet and to ftpd and try a LIST command
with more then 100 arguments

telnet localhost ftp
Trying 127.0.0.1 ...
Connected to localhost.
Escape character is '^]'.
220-
220-  Welcome, archive user.
...
user ftp
331 Guest login ..
pass me@
230 Guest login ok, ..
LIST a a a a a a a a a ..... about a hundred

A trace showed:
read(0, "LIST a a a a a a a a a a a a a a"..., 4096) = 257
.
gettimeofday({864752992, 39532}, NULL)  = 0
getdtablesize()                         = 256
pipe([8, 9])                            = 8
--- SIGSEGV (Segmentation fault) ---
gettimeofday({864752992, 52091}, NULL)  = 0
...

Since, I no longer follow this list regularly, please CC me if any followups
thanks (mail cc to academ).

The for() loop expression doesn't sufficiently check the end of the array

for (gargc = argc = 1; argv[argc]; argc++) 
                      ^^^^^^^^^^^^

argv is local array and may not be null terminated if the number of arguments
goes over MAX_ARGV. Result will be SIGVEC.

cd wu-ftpd/wu-ftpd-2.4.2-beta-13/src; patch < file
*** ./popen.c.orig      Tue May 27 13:12:05 1997
--- ./popen.c   Tue May 27 13:43:42 1997
***************
*** 124,131 ****
      if (pipe(pdes) < 0)
          return (NULL);
  
      /* break up string into pieces */
!     for (argc = 0, cp = program;argc < MAX_ARGV ; cp = NULL)
          if (!(argv[argc++] = strtok(cp, " \t\n")))
              break;
  
--- 124,133 ----
      if (pipe(pdes) < 0)
          return (NULL);
  
+     /* empty the array */
+     memset((char *)argv, '\0', sizeof(argv));
      /* break up string into pieces */
!     for (argc = 0, cp = program;argc < MAX_ARGV - 1 ; cp = NULL)
          if (!(argv[argc++] = strtok(cp, " \t\n")))
              break;

-- 
au revoir, alain
----
Aussi haut que l'on soit assis, on est toujours assis que sur son cul !!!

---

From: Alain Magloire <[email-masked]>
Date: Thu, 29 May 1997 11:06:01 -0400 (EDT)

Bonjour Roger

>  I confirmed this occurs on the Beta 11 version I am running.

Actually if you're using Beta-11, you trigger the first bug :-)
Not the one the post explained.

> Sounds as if it was also confirmed on the latest Beta 13 version.

the second bug is still present in beta-13, yes.

> So has this at least been submitted to Stan this time 
> so it can be included in a future distribution?

For the first one, I've posted a patch on this list
Don't think I cc'ed to academ, it did not matter
since beta-13 corrected the problem

The second was sent to the list and also to academ

Note: Those bugs were discuss on Bugtraq, and comp.secu*
I don't think(I'm no expert) they are suceptible to
stack overflow attacks. But many ftp servers share the
same BSD lineage and can dump core allowing you to
overwrite any files.