plaguez security advisory n. 6 libxview buffer overflows Program: libxview the XView toolkit library, an OpenLook user interface development toolkit. Version: current (3.2p1.4) surely older ones (3.x verified). OS: any OS running X11 and xview. Problem: buffer overflows. Impact: any setuid program using xview is vulnerable and can be used to execute arbitrary commands as the owner of the program. hello, guess what ! Yet another buffer overflow. This one is in the xview library. Well, I should say buffer overflowS because there are several overflows in the code. Most of them happen while getting and environment variable and copying it into a fixed-length buffer. I included in this post the summary of the overflows i found. Note that there may be others as well. Affected functions: ------------------ dflts_put.c static void node_write(path_name, file_name, status, flag) ------------------ font.c static Font_locale_info *find_font_locale_info(server, avlist) ------------------ wckind.c void _wckind_init() ------------------ server.c Pkg_private int server_init(parent, server_public, avlist) static void server_setlocale_to_default(server) static void server_init_atoms(server_public) ------------------ txt_e_menu.c Pkg_private char * textsw_get_extras_filename(mi) ------------------ tty_map_key.c Pkg_private void ttysw_readrc(ttysw) I included this list of vulnerabilities since I'm too lazy and don't have time to make a patch. For the exploits, well, eh, spot a setuid root xview program and implement a standart buffer overflow with any affected environment variable: DEFAULT_FILES, OPENWINHOME, HOME, XVIEW_DEFAULT_LOCALE, PROMPT, that's all folks, plaguez dube0866@eurobretagne.fr ------------------------ plaguez / libpcap dube0866@eurobretagne.fr http://xxx.xxx.xxx ------------------------ ps: if you have a box at the end of a line and would like to see www.plaguez.org instead of xxx.xxx.xxx, please mail me ! :)