TUCoPS :: Unix :: General :: bt565.txt

 ========================================
	 Ph4nt0m Security Advisory 2#2003--7-7
	 ========================================
 Title: zkfingerd-2.0.2(the last version)Format String Vulnerabilities 
 Advisory Number : SRT2003-7-7-002
 Product : zkfingerd
 Version : 2.0.2 (possibility All versions )
 Vendor : http://sourceforge.net/projects/zkfingerd
 Class : Local&remote
 Criticality : high
 Operating System(s) : *nix
 
***************************************************************************
**
 high Level Description : Format String Vulnerabilities in syslog() 
fprintf()
 
***************************************************************************
**
 Technical Details
 ************************************************************************
 zkfingerd-r3-0.9 could be remote exploitable,the last versions 2.0.2 also 
has a bug for Format String Vulnerabilities 
 code find in src/die.c(_finger_error):107
 .........................................
_finger_error(int options, char *function, char *file,
	int line, char *msg, ...)
{
	va_list	ap;
	va_start(ap, msg);
	chomp(msg);
#ifdef	DEBUG
	if(options & DEBUG_ERROR)
		fprintf(stdout, "DBG %s:%s:%d: ", function, file, line);
	else
#endif
	if(!(options & QUIET_ERROR))
		fprintf(stdout, "< ");
	if(strchr(msg, '%') != NULL && !ap)
	{
		if(!(options & QUIET_ERROR))
			fprintf(stdout, msg); .....................point
(msg could be provided by us)
#ifndef	NO_SYSLOG
		syslog(LOG_CRIT, 
msg); .............................possibile
#endif
	}
	else
	{
		if(!(options & QUIET_ERROR))
			vfprintf(stdout, msg, ap);
#ifndef	NO_SYSLOG
		vsyslog(LOG_CRIT, msg, ap);
#endif
	}
	if(!(options & QUIET_ERROR))
	{
#ifdef	DEBUG
		fprintf(stdout, "%s\r\n",
			(!(options & DEBUG_ERROR)) ? " >" : "");
#else
		fprintf(stdout, " >\r\n");
#endif
	}
	va_end(ap);
	fflush(stdout);
	if(options & FATAL_ERROR)
		exit(1);
	return;
}
 
so It is possible to corrupt memory by passing format strings through the 
vulnerable function. This may potentially be exploited to overwrite 
arbitrary locations in memory with attacker-specified values. 
I am studying codes ,i will prodive how to attack &exploit......
...........................................................................
......................
***************************************************************************
**********************
By "jsk" (akun), in ph4nt0m.net(c) Security.
E-mail:jsk@ph4nt0m.net 
ph4nt0m Security Home: http://www.ph4nt0m.net 
My World: http://jsk.njsafe.com
My GnuPG Public Key:http://202.119.104.82/webeq/app/jsk/jsk.asc