[bug-inetutils] Tftp client bugs

[infamous42md]

How long shall I wait to disclose?

Subject:

GNU tftp client remote buffer overflows.

++++++++++++++++++++++++++++++++++++++++++++

Product:

The tftp client that comes with the inetutils package.

++++++++++++++++++++++++++++++++++++++++++++

Vulnerable:

inetutils-1.4.2 was the only version audited.

++++++++++++++++++++++++++++++++++++++++++++

Summary:

Untrusted data is copied into finite static buffers without any bounds checking.
We can overflow several buffers located in the .bss.  Also located in the .bss
are function pointers used to implement ftp commands, so exploitation with code
execution is possible.

++++++++++++++++++++++++++++++++++++++++++++

Details:

The overflows all occur thanks to gethostbyname() returned data.  Instead of
copying that data using the length of the destination buffer, the length of the
source buffer is used instead, or no length at all in the case of strcpy().  An
attacker could configure their DNS server maliciously, or a local attacker on a
LAN could spoof replies to neighbors to exploit this.


main.c:227:             
bcopy(host->h_addr, &peeraddr.sin_addr, host->h_length);   
--
main.c:228:             
strcpy(hostname, host->h_name);     
--
main.c:366:             
bcopy(hp->h_addr, (caddr_t)&peeraddr.sin_addr, hp->h_length);  
--
main.c:369:             
strcpy(hostname, hp->h_name);   
--
main.c-457:         
bcopy(hp->h_addr, (caddr_t)&peeraddr.sin_addr, hp->h_length); 
--
main.c:461:             
strcpy(hostname, hp->h_name);   

++++++++++++++++++++++++++++++++++++++++++++

Exploit:

None provided as these bugs aren't practical to write POC's for.


-- 
-sean