[NT] Cygwin Bash Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Cygwin Bash Buffer Overflow
------------------------------------------------------------------------


SUMMARY

 <http://www.cygwin.com> Cygwin is "a Linux-like environment for Windows. 
GNU BASH is the GNU project's UNIX shell. It replaces the standard UNIX 
Bourne and Korn shells".

The bash binary shipped with Cygwin is vulnerable to buffer overflow when 
it tries to print an overly large buffer to the standard output.

DETAILS

Vulnerable Systems:
 * Bash version 2.05b-17 (shipped with Cygwin).
 * Bash version 3.0-2 (shipped with Cygwin).

Proof of concept:
you@cygwin:~ /usr/bin/bash `perl -e "print 'a'x8388600"`


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
Rodrigo Gutierrez.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.