Debian Bug report logs - #287044
CAN-2004-1282 Buffer overflow in the strexpand function

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Joey Hess <joeyh@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CAN-2004-1282 Buffer overflow in the strexpand function

Date: Thu, 23 Dec 2004 16:12:00 -0500

[Message part 1 (text/plain, inline)]

Package: linpopup
Version: 1.2.0-6
Severity: grave
Tags: security

Linpopup seems to be vuonerable to CAN-2004-1282:

Buffer overflow in the strexpand function in string.c for LinPopUp 1.2.0
allows remote attackers to execute arbitrary code via a crafted message
that is not properly handled during a Reply operation.

Details here: http://tigger.uic.edu/~jlongs2/holes/linpopup.txt

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.4.27
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages linpopup depends on:
ii  debconf                  1.4.41          Debian configuration management sy
ii  libc6                    2.3.2.ds1-19    GNU C Library: Shared libraries an
ii  libglib1.2               1.2.10-9        The GLib library of C routines
ii  libgtk1.2                1.2.10-17       The GIMP Toolkit set of widgets fo
ii  libice6                  4.3.0.dfsg.1-10 Inter-Client Exchange library
ii  libsm6                   4.3.0.dfsg.1-10 X Window System Session Management
ii  libx11-6                 4.3.0.dfsg.1-10 X Window System protocol client li
ii  libxext6                 4.3.0.dfsg.1-10 X Window System miscellaneous exte
ii  libxi6                   4.3.0.dfsg.1-10 X Window System Input extension li
ii  libxmu6                  4.3.0.dfsg.1-10 X Window System miscellaneous util
ii  libxt6                   4.3.0.dfsg.1-10 X Toolkit Intrinsics
pn  samba                                    Not found.
ii  xlibs                    4.3.0.dfsg.1-10 X Keyboard Extension (XKB) configu

-- 
see shy jo

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 287044@bugs.debian.org (full text, mbox, reply):

From: Paul Slootman <paul@debian.org>

To: Joey Hess <joeyh@debian.org>, 287044@bugs.debian.org

Subject: Re: Bug#287044: CAN-2004-1282 Buffer overflow in the strexpand function

Date: Thu, 23 Dec 2004 22:45:17 +0100

[Message part 1 (text/plain, inline)]

On Thu 23 Dec 2004, Joey Hess wrote:
> 
> Buffer overflow in the strexpand function in string.c for LinPopUp 1.2.0
> allows remote attackers to execute arbitrary code via a crafted message
> that is not properly handled during a Reply operation.

OK, quick fix for string.c, I'll look into whether a redesign of the
whole thing might be useful tomorrow...
Opinions? I'll upload in about 30 minutes.


Paul Slootman

[string.c.diff (text/plain, attachment)]

Message #15 received at 287044@bugs.debian.org (full text, mbox, reply):

From: Joey Hess <joeyh@debian.org>

To: Paul Slootman <paul@debian.org>

Cc: 287044@bugs.debian.org

Subject: Re: Bug#287044: CAN-2004-1282 Buffer overflow in the strexpand function

Date: Thu, 23 Dec 2004 17:37:46 -0500

[Message part 1 (text/plain, inline)]

Paul Slootman wrote:
> OK, quick fix for string.c, I'll look into whether a redesign of the
> whole thing might be useful tomorrow...
> Opinions? I'll upload in about 30 minutes.

I'm too brain-dead to have a trustable opinion after going over all
these security holes. :-) I think there was an exploit (may work better
on freebsd), if you want to try to test it.

-- 
see shy jo

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 287044-close@bugs.debian.org (full text, mbox, reply):

From: Paul Slootman <paul@debian.org>

To: 287044-close@bugs.debian.org

Subject: Bug#287044: fixed in linpopup 1.2.0-7

Date: Thu, 23 Dec 2004 17:32:03 -0500

Source: linpopup
Source-Version: 1.2.0-7

We believe that the bug you reported is fixed in the latest version of
linpopup, which is due to be installed in the Debian FTP archive:

linpopup_1.2.0-7.diff.gz
  to pool/main/l/linpopup/linpopup_1.2.0-7.diff.gz
linpopup_1.2.0-7.dsc
  to pool/main/l/linpopup/linpopup_1.2.0-7.dsc
linpopup_1.2.0-7_i386.deb
  to pool/main/l/linpopup/linpopup_1.2.0-7_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 287044@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Slootman <paul@debian.org> (supplier of updated linpopup package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Thu, 23 Dec 2004 22:46:30 +0100
Source: linpopup
Binary: linpopup
Architecture: source i386
Version: 1.2.0-7
Distribution: unstable
Urgency: high
Maintainer: Paul Slootman <paul@debian.org>
Changed-By: Paul Slootman <paul@debian.org>
Description: 
 linpopup   - X Window System port of Winpopup, running over Samba
Closes: 268556 270791 276903 280345 287044
Changes: 
 linpopup (1.2.0-7) unstable; urgency=high
 .
   * Fixed vulnerability CAN-2004-1282
     closes:#287044
   * Updated German debconf translation, thanks to Jens Nachtigall.
     closes:#276903
   * Updated Dutch debconf translation, thanks to Luk Claes / cobaco
     (As cobaco's version is later and also vetted by the debian-l10n-dutch
     team, I'm using that one. Thanks to Luk Claes anyway!)
     closes:#270791,#280345
   * Replaced "Xwindow" in the description with "X Window System".
     closes:#268556
   * Samba changed again... find out the installed samba version differently.
Files: 
 f43d23ad15bfe9ecf2c2fcf90cc889c9 587 net optional linpopup_1.2.0-7.dsc
 b3e87f70753239933749c18c8fef9fc6 19416 net optional linpopup_1.2.0-7.diff.gz
 21453c449f5680811518e86f5bffc1e1 77828 net optional linpopup_1.2.0-7_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBy0KbutvvqbTW3hMRAg8iAJ91Pp4wGc4qbxfhiEYDzr5AuRoJmQCdF3dE
d22B/pN4J3dkBw+97qNguGI=
=+e+W
-----END PGP SIGNATURE-----

Message #25 received at 287044@bugs.debian.org (full text, mbox, reply):

From: Paul Slootman <paul@debian.org>

To: Joey Hess <joeyh@debian.org>

Cc: 287044@bugs.debian.org

Subject: Re: Bug#287044: CAN-2004-1282 Buffer overflow in the strexpand function

Date: Thu, 23 Dec 2004 23:50:35 +0100

On Thu 23 Dec 2004, Joey Hess wrote:
> Paul Slootman wrote:
> > OK, quick fix for string.c, I'll look into whether a redesign of the
> > whole thing might be useful tomorrow...
> > Opinions? I'll upload in about 30 minutes.
> 
> I'm too brain-dead to have a trustable opinion after going over all
> these security holes. :-) I think there was an exploit (may work better
> on freebsd), if you want to try to test it.

I'll try to contact the exploit discoverer; I've tried to google for the
example message that demonstrates the exploit on freebsd, but haven't
found it yet.

In the meantime I've uploaded a version with my fix in it.


Thanks,
Paul Slootman

Message #30 received at 287044@bugs.debian.org (full text, mbox, reply):

From: Gerrit Pape <pape@dbnbgs.smarden.org>

To: Paul Slootman <paul@debian.org>, 287044@bugs.debian.org

Cc: Joey Hess <joeyh@debian.org>

Subject: Re: Bug#287044: CAN-2004-1282 Buffer overflow in the strexpand function

Date: Thu, 23 Dec 2004 23:15:28 +0000

On Thu, Dec 23, 2004 at 11:50:35PM +0100, Paul Slootman wrote:
> I'll try to contact the exploit discoverer; I've tried to google for the
> example message that demonstrates the exploit on freebsd, but haven't
> found it yet.

It's on the securesoftware mailing list
 http://securesoftware.list.cr.yp.to/archive/0/12

See
 http://securesoftware.list.cr.yp.to/archive/0/09
 http://securesoftware.list.cr.yp.to/archive/0/10
 ...
 http://securesoftware.list.cr.yp.to/archive/0/53

Regards, Gerrit.

Message #35 received at 287044@bugs.debian.org (full text, mbox, reply):

From: Paul Slootman <paul@debian.org>

To: Gerrit Pape <pape@dbnbgs.smarden.org>

Cc: 287044@bugs.debian.org

Subject: Re: Bug#287044: CAN-2004-1282 Buffer overflow in the strexpand function

Date: Fri, 24 Dec 2004 13:44:59 +0100

On Thu 23 Dec 2004, Gerrit Pape wrote:
> On Thu, Dec 23, 2004 at 11:50:35PM +0100, Paul Slootman wrote:
> > I'll try to contact the exploit discoverer; I've tried to google for the
> > example message that demonstrates the exploit on freebsd, but haven't
> > found it yet.
> 
> It's on the securesoftware mailing list
>  http://securesoftware.list.cr.yp.to/archive/0/12

Thanks!

I've confirmed that my version doesn't do anything strange with that
prepared message.


Paul Slootman

Send a report that this bug log contains spam.