Onderwerp: GNU/Linux 'info Buffer Overflow

Package: info
Version: 4.7-2.1
Severity: grave
Tags: security
Justification: user security hole



-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.7
Locale: LANG=C, LC_CTYPE=C

Versions of packages info depends on:
ii libc6 2.3.2.ds1-15 GNU C Library: Shared libraries an
ii libncurses5 5.4-4 Shared libraries for terminal hand

-- no debconf information

Information:
I have tested several versions (Debian stable, unstable and testing) and
have found that this bug exists in all versions tested. I have included
a small --restore script that can be used to leverage a simple Seg fault.
This buffer overflow is very trivial to leverage as there are several
bytes available (10-15+). It may be possible that arbitary system calls
could be made though this hole. It is also possible to leverage this
from the command line using the --restore=FILENAME flag, and need not
have the program running. Although it is not running as suid, or as a
daemon, in a case where info is being used as a public service, it may
be a security problem. This bug seems only to be accessable where the
file has xrefs available.

Walkthrough:
$ info info
[info screen comes up]
press 'g'
[Goto Node:]
type 'Expert Info' <enter>

(OR any other way to get to a page with xrefs)

press 'f'
Type in 225 or more bytes and press enter.
SEG FAULT!

Example File:
The following can be saved to a file and called as:
info info --restore=info.bug to create a segmentation fault.

[START info.bug]
gExpert Info
fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAA

[END info.bug]

--==_Exmh_1909289544P
Content-Type: text/plain; charset=us-ascii

On Fri, 06 Aug 2004 00:46:21 -0000, Josh Martin <skizzles@gmail.com> said:

> Package: info
> Version: 4.7-2.1
> Severity: grave
> Tags: security
> Justification: user security hole

> This buffer overflow is very trivial to leverage as there are several
> bytes available (10-15+). It may be possible that arbitary system calls
> could be made though this hole. It is also possible to leverage this
> from the command line using the --restore=FILENAME flag, and need not
> have the program running. Although it is not running as suid, or as a
> daemon, in a case where info is being used as a public service, it may
> be a security problem.

Well.. it may be a problem if you can convince root (or somebody else not
yourself) to go to an 'info' page and enter 'f' and 225 bytes and hit return,
or to convince root to run a 'info --restore=' command. Barring that,
I'm failing to see how it's a "grave" severity - unless there's a way to leverage
it or social-engineer it that I'm missing, if this is "grave" then *every* bug that
results in a SIGSEGV is grave.....

--==_Exmh_1909289544P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFBE+SacC3lWbTT17ARAogRAJ0VsQtpc/orpBZYLtZqHXAcHsDJ9ACfdvkY
x4Ct7xCboHvn+PpwQDy4nQQ=
=Bg7f
-----END PGP SIGNATURE-----

--==_Exmh_1909289544P--

* skizzles@gmail.com (Josh Martin) [Fri 06 Aug 2004, 20:51 CEST]:
> Package: info
> Version: 4.7-2.1
> Severity: grave
> Tags: security
> Justification: user security hole
[snip explanation of buffer overflow]

/usr/bin/info is not setuid, and I can't think of any way to invoke the
program where it would allow for privilege escalation. Why is the
severity "grave?" Remember that this is bugtraq, about security, not
the Debian bug tracking system, or texinfo's gnats.


-- Niels.

--
(please change - to = in my From: address when replying, the amount of
bounces otherwise coming back from bugtraq is of epic proportions.)

Dnia pi=B1tek, 6 sierpnia 2004 02:46, Josh Martin napisa=B3:
> Package: info
> Version: 4.7-2.1
> Severity: grave
> Tags: security
> Justification: user security hole

'Severe' is to severe a word, but for anybody who's interested, here goes a=
=20
patch:

diff -urN texinfo-4.7/info/echo-area.c texinfo-4.7.patch/info/echo-area.c
=2D-- texinfo-4.7/info/echo-area.c 2004-03-14 01:57:29.000000000 +01=
00
+++ texinfo-4.7.patch/info/echo-area.c 2004-08-07 01:06:49.000000000 +0200
@@ -1510,8 +1510,8 @@
text[i] =3D 0;

echo_area_initialize_node ();
=2D sprintf (&input_line[input_line_end], "%s[%s]\n",
=2D echo_area_is_active ? " ": "", text);
+ snprintf (&input_line[input_line_end], EA_MAX_INPUT + 1 - input_line_end,
+ "%s[%s]\n", echo_area_is_active ? " ": "", text);
free (text);
the_echo_area->point =3D input_line_point;
display_update_one_window (the_echo_area);



=2D-=20
/* Roman Werpachowski */

Ten e-mail zosta=B3 sprawdzony i
zaakceptowany przez fretk=EA Tintin.

--DBIVS5p969aUjpLe
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Aug 06, 2004 at 11:41:12PM +0200, Niels Bakker wrote:
> /usr/bin/info is not setuid, and I can't think of any way to invoke the
> program where it would allow for privilege escalation. Why is the
> severity "grave?" Remember that this is bugtraq, about security, not
> the Debian bug tracking system, or texinfo's gnats.

I think that the severity is overstated for Debian BTS too, IMO - and
according to Debian Policy - this should be 'normal' or 'serious' at
highest.

Alex

PS> Niels, your advertised address bounces with virtusertable errors,
I tried to send this offlist first.
--=20
0x46399138

--DBIVS5p969aUjpLe
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.3.6 (GNU/Linux)

iD8DBQFBFPW+i2676t/eTc4RA44XAJ4uoqipLuvAM7uAksPZ2QDWRc7RigCfal+R
XGtLUPnc/KYSYB0gKfn78X8=
=otq9
-----END PGP SIGNATURE-----

--DBIVS5p969aUjpLe--