[bug-inetutils] telnet (GNU inetutils) 1.7 cmdrc() local buffer overflow hole

[王智通]

Dear, all:

 

   I download gnu telnet code from http://ftp.gnu.org/gnu/inetutils/inetutils-1.7.tar.gz. In the telnet code in commands.c,

I found this function has a local buffer overflow bug, see:

 

Commands.c:

 

static char *rcname = 0;

static char rcbuf[128];

 

static void

cmdrc (char *m1, char *m2)

{

  if (rcname == 0)

    {

   rcname = getenv ("HOME");   // when the getenv()  get the HOME environment value, It not test the length of the value, and then copy it to the rcbuf. If the length is too long(>128), it will cause a buffer overflow.

      if (rcname)

         strcpy (rcbuf, rcname);

      else

         rcbuf[0] = '\0';

      strcat (rcbuf, "/.telnetrc");

      rcname = rcbuf;

}

 

You can test it with:

 

Export HOME=”aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa”

 

./telnet localhost 22

 

My terminal has crashed.

 

And my patch is:

 

diff -Nur inetutils-1.7/telnet/commands.c inetutils-1.7-new/telnet/commands.c

--- inetutils-1.7/telnet/commands.c     2009-12-14 19:36:17.000000000 +0800

+++ inetutils-1.7-new/telnet/commands.c 2009-12-27 19:02:44.000000000 +0800

@@ -3029,6 +3029,8 @@

   if (rcname == 0)

     {

       rcname = getenv ("HOME");

+      if (strlen(rcname) > 128)

+        return ;

       if (rcname)

        strcpy (rcbuf, rcname);

       else

 

 

---

This email (including any attachments) is confidential and may be legally privileged. If you received this email in error, please delete it immediately and do not copy it or use it for any purpose or disclose its contents to any other person. Thank you.

本电邮(包括任何附件)可能含有机密资料并受法律保护。如您不是正确的收件人，请您立即删除本邮件。请不要将本电邮进行复制并用作任何其他用途、或透露本邮件之内容。谢谢。