oss-security - CVE Request: Planeshift buffer overflow

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 17 May 2012 09:52:09 -0500
From: Andres Gomez <agomez@...idsignal.com>
To: oss-security@...ts.openwall.com, bugtraq@...urityfocus.com, 
	vuln@...unia.com
Subject: CVE Request: Planeshift buffer overflow

Name: Stack-based buffer overflow in Planeshift 0.5.9 and earlier
Software: Planeshift 0.5.9
Software link: http://www.planeshift.it/
Vulnerability Type: Buffer overflow

Vulnerability Details:

There is a buffer overflow in planeshift/src/client/chatbubbles.cpp line
223:

       .
       .
       .

        // align
        csString align = chatNode->GetAttributeValue("align");
        align.Downcase();
        if (align == "right")
            chat.textSettings.align = ETA_RIGHT;
        else if (align == "center")
            chat.textSettings.align = ETA_CENTER;
        else
            chat.textSettings.align = ETA_LEFT;

        // prefix
223>  strcpy(chat.effectPrefix,
chatNode->GetAttributeValue("effectPrefix"));

        //enabled
        .
        .
        .

this line reads a tag inside chatbubbles.xml called effectPrefix. If that
string is very long, for example:

<chat type="say" enabled="yes" colourR="186" colourG="168" colourB="126"
shadowR="108" shadowG="98" shadowB="73" align="left"
effectPrefix="chatbubble_AAAAA....AAAAA" />

It will overwrite effectPrefix[64] buffer, which can lead even to arbitrary
code execution.

Could a CVE be assigned to this issue?

Thanks,

Andres Gomez.

-- 
--
AVISO DE CONFIDENCIALIDAD:

Esta transmisión se entiende para uso del destinatario o la entidad a la 
que va dirigida y puede contener información confidencial o protegida por 
la ley. Si el lector de este mensaje no fuera el destinatario, considérese 
por este medio informado que la retención, difusión, o copia de este correo 
electrónico está estrictamente prohibida. Si recibe este mensaje por error, 
por favor notifique inmediatamente al emisor y destruya el original. Gracias

--
CONFIDENTIALITY NOTICE:

This transmission is intended for the use of the individual or entity to 
which it is addressed, and it may contain information that is confidential 
or privileged under law. If the reader of this message is not the intended 
recipient, you are hereby notified that retention, dissemination, 
distribution or copying of this e-mail is strictly prohibited. If you 
received this e-mail in error, please notify the sender immediately and 
destroy the original. Thank you.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.