109763 2003-08-14 17:40 /174 rader/ Timo Sirainen <tss@iki.fi>
Importerad: 2003-08-14 17:40 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <6016>
Ärende: Ecartis 1.0 multiple vulnerabilities
------------------------------------------------------------
Ecartis is a modular mailing list manager, previously called Listar.
I reported these in Ecartis' bug database sometimes in
May. Remembered it again in June and sent a reminder mail to
ecartis-dev list. Remembered it again today and looks like nothing is
still done. Just so it won't get completely forgotten, here's the
what I found:
Buffer overflows
----------------
Several. I fixed what I found, included patch below (compiles, not
tested). There might be more, these are the ones I found in a few
minutes.
liscript problems
-----------------
Ecartis contains liscript that supports some variables and
functions. User input is fully trusted in several places which allows
calling those functions or viewing variables.
For example send mail to ecartis@host.com:
subscribe secret-list
subscribe <$post-password>
First command fails, but it selects the secret-list as active
list. Second command of course fails, but the reply mail expands the
post-password to the real password.
This is a bigger job to fix and not that critical, so no patch from
me.
tar
---
This is completely unrelated to Ecartis, but the timing is good
enough to mention this here and get it a bit publicity, hopefully
positive :) I was just thinking that automated pgp-signature checking
in tars would be nice.
http://mail.gnu.org/archive/html/bug-tar/2003-08/msg00013.html
patch
-----
diff -ru ecartis-1.0.0-old/src/smtp.c ecartis-1.0.0/src/smtp.c
--- ecartis-1.0.0-old/src/smtp.c Fri Apr 18 09:45:04 2003
+++ ecartis-1.0.0/src/smtp.c Thu Aug 14 17:30:24 2003
@@ -330,18 +330,19 @@
return 1;
}
-void smtp_body_822bis(const char *src, char *dest)
+void smtp_body_822bis(const char *src, char *dest, size_t size)
{
const char *ptr1;
- char *ptr2;
+ char *ptr2, *end;
int lastcr;
lastcr = 0;
ptr1 = src;
ptr2 = dest;
+ end = dest + size - 2;
- while(*ptr1) {
+ while(*ptr1 && ptr2 < end) {
if ((*ptr1 == '\n') && (!lastcr)) {
*ptr2++ = '\r';
} else if (*ptr1 == '\r') {
@@ -367,7 +368,7 @@
{
char buffer[HUGE_BUF];
- smtp_body_822bis(line,&buffer[0]);
+ smtp_body_822bis(line,&buffer[0], sizeof(buffer));
clean_var("smtp-last-error", VAR_TEMP);
if (!sock_printf(my_socket,"%s",buffer)) {
@@ -385,7 +386,7 @@
buffer_printf(buffer2, sizeof(buffer2) - 1, "%s\r\n", line);
- smtp_body_822bis(buffer2,&buffer[0]);
+ smtp_body_822bis(buffer2,&buffer[0], sizeof(buffer));
clean_var("smtp-last-error", VAR_TEMP);
if (!sock_printf(my_socket,"%s",buffer)) {
diff -ru ecartis-1.0.0-old/src/unhtml.c ecartis-1.0.0/src/unhtml.c
--- ecartis-1.0.0-old/src/unhtml.c Fri Apr 18 09:45:04 2003
+++ ecartis-1.0.0/src/unhtml.c Thu Aug 14 17:43:03 2003
@@ -161,6 +161,25 @@
case HTMLPARSE_NORMAL:
case HTMLPARSE_EATTAG:
{
+ /* Wordwrap */
+ if (linechars > 76) {
+ char tempbuf[1024];
+ *tptr = 0;
+
+ tptr = strrchr(linebuffer,' ');
+ if (!tptr) tptr = strrchr(linebuffer,'-');
+ if (!tptr) tptr = &tempbuf[76];
+
+ buffer_printf(tempbuf,1023,"%s",
+ (*tptr == ' ') ? tptr + 1 : tptr);
+ *tptr = 0;
+
+ newline(outfile,&linebuffer[0],indent,linemode);
+ buffer_printf(linebuffer,79,"%s",tempbuf);
+ tptr = &linebuffer[strlen(linebuffer)];
+ linechars = strlen(linebuffer);
+ lastspace = 1;
+ }
if (tempchar == '&') {
memset(buffer, 0, sizeof(buffer));
tagptr = &buffer[0];
@@ -182,25 +201,6 @@
lastspace = (tempchar == ' ');
}
- /* Wordwrap */
- if (linechars > 76) {
- char tempbuf[1024];
- *tptr = 0;
-
- tptr = strrchr(linebuffer,' ');
- if (!tptr) tptr = strrchr(linebuffer,'-');
- if (!tptr) tptr = &tempbuf[76];
-
- buffer_printf(tempbuf,1023,"%s",
- (*tptr == ' ') ? tptr + 1 : tptr);
- *tptr = 0;
-
- newline(outfile,&linebuffer[0],indent,linemode);
- buffer_printf(linebuffer,79,"%s",tempbuf);
- tptr = &linebuffer[strlen(linebuffer)];
- linechars = strlen(linebuffer);
- lastspace = 1;
- }
}
}
break;
@@ -338,7 +338,8 @@
}
parsemode = HTMLPARSE_NORMAL;
} else {
- *tagptr++ = tempchar;
+ if (tagptr < buffer + sizeof(buffer) - 1)
+ *tagptr++ = tempchar;
}
}
break;
diff -ru ecartis-1.0.0-old/src/unmime.c ecartis-1.0.0/src/unmime.c
--- ecartis-1.0.0-old/src/unmime.c Fri Apr 18 09:45:04 2003
+++ ecartis-1.0.0/src/unmime.c Thu Aug 14 17:22:36 2003
@@ -98,7 +98,7 @@
tptr2 = &temp2[0];
- while (*tptr && (*tptr != '=')) {
+ while (*tptr && (*tptr != '=') && tptr2 < temp2 + sizeof(temp2) - 1) {
if (!isspace((int)*tptr)) *tptr2++ = *tptr;
tptr++;
}
@@ -116,7 +116,7 @@
tptr2 = &temp2[0];
- while (*tptr && (*tptr != ';')) {
+ while (*tptr && (*tptr != ';') && tptr2 < temp2 + sizeof(temp2) - 1) {
if ( (!escape) && isspace((int)*tptr) ) {
if (!eattrail) {
/* We store the position to remove end spaces */
(109763) /Timo Sirainen <tss@iki.fi>/-----(Ombruten)