Problema:
Multiples vulnerabilidades han sido encontradas en el Ecartis 1.0:
1) Los archivos smtp.c, unhttp.c, y unmime.c contienen "buffer overflows". Estos permite a un atacante remoto ejecutar codigo arbitrariamente.
2) Ejemplo: mandar un mail a "ecartis@host.com":
subscribe secret-list
subscribe <$post-password>
El primer comandos va a fallar, pero la lista secret-list a sido seleccionada como una lista activa. El segundo comando por supuesto falla tambien, pero con un mail de reply expandiendo el "post-password" al password real.
Versiones vulnerables:
Ecartis 1.0
Solución:
Este es uno de los parches:
diff -ru ecartis-1.0.0-old/src/smtp.c ecartis-1.0.0/src/smtp.c
— ecartis-1.0.0-old/src/smtp.c Fri Apr 18 09:45:04 2003
+++ ecartis-1.0.0/src/smtp.c Thu Aug 14 17:30:24 2003
@@ -330,18 +330,19 @@
return 1;
}
-void smtp_body_822bis(const char *src, char *dest)
+void smtp_body_822bis(const char *src, char *dest, size_t size)
{
const char *ptr1;
- char *ptr2;
+ char *ptr2, *end;
int lastcr;
lastcr = 0;
ptr1 = src;
ptr2 = dest;
+ end = dest + size - 2;
- while(*ptr1) {
+ while(*ptr1 && ptr2 < end) {
if ((*ptr1 == ‘\n’) && (!lastcr)) {
*ptr2++ = ‘\r’;
} else if (*ptr1 == ‘\r’) {
@@ -367,7 +368,7 @@
{
char buffer[HUGE_BUF];
- smtp_body_822bis(line,&buffer[0]);
+ smtp_body_822bis(line,&buffer[0], sizeof(buffer));
clean_var("smtp-last-error", VAR_TEMP);
if (!sock_printf(my_socket,"%s",buffer)) {
@@ -385,7 +386,7 @@
buffer_printf(buffer2, sizeof(buffer2) - 1, "%s\r\n", line);
- smtp_body_822bis(buffer2,&buffer[0]);
+ smtp_body_822bis(buffer2,&buffer[0], sizeof(buffer));
clean_var("smtp-last-error", VAR_TEMP);
if (!sock_printf(my_socket,"%s",buffer)) {
diff -ru ecartis-1.0.0-old/src/unhtml.c ecartis-1.0.0/src/unhtml.c
— ecartis-1.0.0-old/src/unhtml.c Fri Apr 18 09:45:04 2003
+++ ecartis-1.0.0/src/unhtml.c Thu Aug 14 17:43:03 2003
@@ -161,6 +161,25 @@
case HTMLPARSE_NORMAL:
case HTMLPARSE_EATTAG:
{
+ /* Wordwrap */
+ if (linechars > 76) {
+ char tempbuf[1024];
+ *tptr = 0;
+
+ tptr = strrchr(linebuffer,’ ‘);
+ if (!tptr) tptr = strrchr(linebuffer,’-');
+ if (!tptr) tptr = &tempbuf[76];
+
+ buffer_printf(tempbuf,1023,"%s",
+ (*tptr == ‘ ‘) ? tptr + 1 : tptr);
+ *tptr = 0;
+
+ newline(outfile,&linebuffer[0],indent,linemode);
+ buffer_printf(linebuffer,79,"%s",tempbuf);
+ tptr = &linebuffer[strlen(linebuffer)];
+ linechars = strlen(linebuffer);
+ lastspace = 1;
+ }
if (tempchar == ‘&’) {
memset(buffer, 0, sizeof(buffer));
tagptr = &buffer[0];
@@ -182,25 +201,6 @@
lastspace = (tempchar == ‘ ‘);
}
- /* Wordwrap */
- if (linechars > 76) {
- char tempbuf[1024];
- *tptr = 0;
-
- tptr = strrchr(linebuffer,’ ‘);
- if (!tptr) tptr = strrchr(linebuffer,’-');
- if (!tptr) tptr = &tempbuf[76];
-
- buffer_printf(tempbuf,1023,"%s",
- (*tptr == ‘ ‘) ? tptr + 1 : tptr);
- *tptr = 0;
-
- newline(outfile,&linebuffer[0],indent,linemode);
- buffer_printf(linebuffer,79,"%s",tempbuf);
- tptr = &linebuffer[strlen(linebuffer)];
- linechars = strlen(linebuffer);
- lastspace = 1;
- }
}
}
break;
@@ -338,7 +338,8 @@
}
parsemode = HTMLPARSE_NORMAL;
} else {
- *tagptr++ = tempchar;
+ if (tagptr < buffer + sizeof(buffer) - 1)
+ *tagptr++ = tempchar;
}
}
break;
diff -ru ecartis-1.0.0-old/src/unmime.c ecartis-1.0.0/src/unmime.c
— ecartis-1.0.0-old/src/unmime.c Fri Apr 18 09:45:04 2003
+++ ecartis-1.0.0/src/unmime.c Thu Aug 14 17:22:36 2003
@@ -98,7 +98,7 @@
tptr2 = &temp2[0];
- while (*tptr && (*tptr != ‘=’)) {
+ while (*tptr && (*tptr != ‘=’) && tptr2 < temp2 + sizeof(temp2) - 1) {
if (!isspace((int)*tptr)) *tptr2++ = *tptr;
tptr++;
}
@@ -116,7 +116,7 @@
tptr2 = &temp2[0];
- while (*tptr && (*tptr != ‘;’)) {
+ while (*tptr && (*tptr != ‘;’) && tptr2 < temp2 + sizeof(temp2) - 1) {
if ( (!escape) && isspace((int)*tptr) ) {
if (!eattrail) {
/* We store the position to remove end spaces */
Referencia
http://www.securityfocus.com/archive/1/333209
