Re: [remote] [control] Mesh Viewer 0.2.2 Mesh::type overflows s1 buffer

Thank you, for your note. This is a very valid point, indeed. I will look into
it and review the whole source code as soon as I can.

Regards, Helmut Cantzler

On Wednesday 15 December 2004 09:25, D. J. Bernstein wrote:
> Mohammed Khan and Danny Lungstrom, two students in my Fall 2004 UNIX
> Security Holes course, have discovered a remotely exploitable security
> hole in Mesh Viewer. I'm publishing this notice, but all the discovery
> credits should be assigned to Khan and Lungstrom.
>
> You are at risk if you take a mesh file from an email message (or a web
> page or any other source that could be controlled by an attacker) and
> feed that document through mview. Whoever provides that document then
> has complete control over your account: he can read and modify your
> files, watch the programs you're running, etc.
>
> The Mesh Viewer documentation does not tell users to avoid taking input
> from the network. In fact, the Mesh Viewer web page specifically points
> to web pages with sample meshes.
>
> Proof of concept: On an x86 computer running FreeBSD 4.10, as root, type
>
>    cd /usr/ports/graphics/meshviewer
>    make install
>
> to download and compile the Mesh Viewer program, version 0.2.2
> (current). Then, as any user, save the file 46.mesh attached to this
> message, and type
>
>    mview 46.mesh
>
> with the unauthorized result that a file named ``exploited'' is created
> in the current directory.
>
> Here's the bug: In mesh.c, Mesh::type() uses fscanf() to read any number
> of bytes into the 20-byte s1 and s2 arrays.
>
> ---D. J. Bernstein, Associate Professor, Department of Mathematics,
> Statistics, and Computer Science, University of Illinois at Chicago