[prev in list] [next in list] [prev in thread] [next in thread] 

List:       sr-dev
Subject:    [Devel] [ openser-Bugs-1620701 ] Buffer overflow by long lines in
From:       noreply () sourceforge ! net (SourceForge ! net)
Date:       2006-12-22 12:33:11
Message-ID: E1Gxigc-0001mu-Ab () sc8-sf-monitor2 ! sourceforge ! net
[Download RAW message or body]

Bugs item #1620701, was opened at 2006-12-22 11:50
Message generated for change (Comment added) made by bogdan_iancu
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=1620701&group_id=139143

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: modules
Group: None
Status: Open
> Resolution: Accepted
Priority: 5
Private: No
Submitted By: Bastian Friedrich (bastian)
Assigned to: Nobody/Anonymous (nobody)
Summary: Buffer overflow by long lines in permissions

Initial Comment:
Hi,

today a bug in OpenSER was reported on bugtraq (not found by me!):
http://www.securityfocus.com/archive/1/455097/30/0/threaded

String lengths are not properly checked in parse_expression_list \
(modules/permissions/parse_config.c) while copying from input variable str (up to 500 \
chars) to str2 (up to 100 chars).

I can reproduce the problem by using a line like
ALLLLLLL (500 L's) : ALLLLLLL (another 500 L's) in a permission file.

As the configuration file is under administrative control, no security breach is \
directly implied.

Best,
   Bastian


----------------------------------------------------------------------

> Comment By: Bogdan (bogdan_iancu)
Date: 2006-12-22 13:35

Message:
Logged In: YES 
user_id=1275325
Originator: NO

Hi Bastian,

actually is more than this - there are also no check when copying from
file to the line buffer (500 chars max). Looks like there is a lot of work
to be done there.

Thanks for report - we will take care of it.

regards,
bogdan

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=1620701&group_id=139143


[prev in list] [next in list] [prev in thread] [next in thread]