Vulnerability Development: Re: Buffer overflow in procmail [suid!]

[Aaron Campbell <aaron () CS DAL CA>]

On Thu, 10 Aug 2000, Tobias von Koch wrote:

> I think I've found a buffer overflow in procmail from Redhat 6.2 (v3.14
> 1999/11/22, others not tested).
[snip]

> $ /usr/bin/procmail x=`perl -e "print 1x2054"`
>  <Ctrl>-D
> Segmentation fault
>
> You can get root privileges (with some code) now....
The overflow occurs at the following call in asenvcpy() (in misc.c):

        strcpy((char*)(sgetcp=buf2),++src);

Notice right before that is a call to setids(). So procmail drops its
privileges before the overflow occurs.

But yikes, what a mess of code to read. Why is the source like this? Is it
optimized for speed of compilation or something?

  .
 :  Aaron Campbell <aaron () cs dal ca> - [ http://www.biodome.org/~fx ]
  `-------------------------------------------------------------------