From snsadv@lac.co.jp Thu Jun 21 00:07:08 2001 From: "snsadv@lac.co.jp" To: bugtraq@securityfocus.com Date: Thu, 21 Jun 2001 14:34:36 +0900 Subject: [SNS Advisory No.32] w3m malformed MIME header Buffer Overflow Vulnerability [The following text is in the "iso-2022-jp" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] ----------------------------------------------------------------------- SNS Advisory No.32 w3m malformed MIME header Buffer Overflow Vulnerability Problem first discovered: Thu, 25 May 2001 Published: Wed, 19 Jun 2001 Last Updated: Wed, 19 Jun 2001 ---------------------------------------------------------------------- Overview -------- w3m, a text file/Web browser which is similar to lynx, has a buffer overflow vulnerability in a routine to parse MIME header. If a user retrieves/downloads a malformed Web page with w3m, a malicious Web server administrator may gain an escalated privilege from the w3m user, which is run by w3m remotely. Problem Description ------------------- w3m handles MIME header included in the request/response massage within the HTTP session like other web browsers. A buffer overflow will be occuerred when w3m accept MIME encoded header with a base 64 format. The length of encoded header must be over 34 characters. The following are a memory dump and contents of register when a buffer overflow is occurred. MIME header: =?AAAAAAAAAAAAAA(50 'A' characters in the header)AAAAAAAA?= memory dump:  0xbffff8a0: 0x41414141 0x41414141 0x41414141 0x41414141  0xbffff8b0: 0x41414141 0x41414141 0x41414141 0x41414141  0xbffff8c0: 0x41414141 0x41414141 0x41414141 0x41414141  0xbffff8d0: 0xbf0a4141 0x080e0000 0x00000001 0x080792c3 register:  ESP: 0xbffff8d0  EIP: 0x41414141 If a remote Web administrator (a remote attacker) could embed codes in the 0x41 part and control the EIP, it is possible to execute arbitrary codes in the privilege of w3m user. Tested Version --------------  w3m 0.2.1 Tested OS ---------  RedHat 7.0J Solaris 7 (x86) Patch Information ----------------- A patch to fix this issue is announced from a developer's mailing list of w3m. A patch to fix this issue[Archive number 2066]: http://mi.med.tohoku.ac.jp/~satodai/w3m-dev/200106.month/2066.html A recommendation to clean up #2066: http://mi.med.tohoku.ac.jp/~satodai/w3m-dev/200106.month/2067.html Discovered by ------------- OGASAWARA Satoshi (LAC / s.ogaswr@lac.co.jp) KOBAYASHI Shigehiro (LAC / sigehiro@lac.co.jp) Disclaimer ---------- All information in this advisories are subject to change without any advanced notices neither mutual consensus, and each of them is released as it is. LAC Co.,Ltd. is not responsible for any risks of occurrences caused by applying those information. References ---------- w3m official page(English): http://ei5nazha.yz.yamagata-u.ac.jp/~aito/w3m/eng/index.html w3m official page(Japanese): http://ei5nazha.yz.yamagata-u.ac.jp/~aito/w3m/index.html Archive of this advisory: http://www.lac.co.jp/security/english/snsadv_e/32_e.html SNS Advisory: http://www.lac.co.jp/security/english/snsadv_e/ LAC: http://www.lac.co.jp/security/english/ ------------------------------------------------------------------ Secure Net Service(SNS) Security Advisory Computer Security Laboratory, LAC http://www.lac.co.jp/security/