=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D
=A0 HPUX dtmailpr buffer overflow vulnerability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=20

Davide Del Vecchio Adv#8

Discovered in: 14/07/2003
Date: 19/11/2003
Tested on HP-UX B.11.00=20


Description:

=A0 The dtmailpr program reads a filename (which contains one or more mail
=A0 messages from mailx or dtmail ), and sends the message to standard out
  with headers abbreviated and attachments removed.=A0=A0If no filename arg=
ument  =20
  is provided dtmailpr reads from standard in.

dante@sofficino :/usr/dt/bin >ls -al /usr/dt/bin/dtmailpr
=A0-r-xr-sr-x =A0 1 bin =A0 =A0 =A0 =A0mail =A0 =A0 =A0 =A0339968 Sep 11 =
=A02001 dtmailpr


Exporting the DISPLAY variable with a long argument...

dante@sofficino :/usr/dt/bin >export DISPLAY=3D"`perl -e 'printf "A" x 9777=
'`"
dante@sofficino :/usr/dt/bin >/usr/dt/bin/dtmailpr
Memory fault

=46rom gdb output we could see the program received signal SIGSEGV,
and then it segfaults.

Solution:=20

I'm in contact with HP's Security staff, especially with John Morris,
and I would like to thanks him and all his staff for the interest
demonstrated during this period of research on HP-UX.
He assured me a patch has been written and an Official Security Bullettin
will follow my advisory.

Credits:

Davide Del Vecchio would like to thank all the people supporting him
and his research, Diego Fuggetta, Filippo Sismondo, Carlo Martini,
Giorgio Vitelli, Davide Zanella, his love that never leaves him alone,
and obvious, the HP-UX security staff, impersonified in this case by
John Morris.=20

My sadness for the victims of the war in Iraq is as big as my desire to
understand why this war started. Repose in peace.

Disclaimer:

The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event shall
the author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.
^^^^^^^^

Please send suggestions, updates, and comments to:
Davide Del Vecchio , Dante Alighieri - dante at alighieri dot org
www.alighieri.org

=2D-=20
=2D - - - - - - - -
Davide Del Vecchio "Dante Alighieri" dante@alighieri.org
http://www.alighieri.org
=2D - - - - - - - -