[UNIX] Buffer Overflow in Mpg123 (getauthfromURL)

From: SecuriTeam (support_at_securiteam.com)
Date: 10/21/04

  • Next message: SecuriTeam: "[TOOL] Stp-Packet - Testing the Security of Spanning Tree Protocol" 
    To: list@securiteam.com
Date: 21 Oct 2004 20:11:30 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Buffer Overflow in Mpg123 (getauthfromURL)
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.mpg123.de/> Mpg123 is a real time MPEG Audio Player for Layer
    1,2 and Layer3 for the Unix/Linux environment.
    Mpg123 is vulnerable to a buffer overflow in the authentication part of
    the URL.

    DETAILS

    Vulnerable Systems:
     * mpg123-pre0.59s;
     * mpg123-0.59r.

    Vulnerable Code:
    The buffer overflow occurs in the function getauthfromURL

    // httpget.c, line 114
    int getauthfromURL(char *url,char *auth)
    {
      char *pos;

      *auth = 0;

      if (!(strncmp(url, "http://", 7)))
        url += 7;

      if( (pos = strchr(url,'@')) ) {
        int i;
        for(i=0;i<pos-url;i++) {
          if( url[i] == '/' )
             return 0;
        }
        strncpy(auth,url,pos-url); <-- HERE
        auth[pos-url] = 0;
        strcpy(url,pos+1);
        return 1;
      }
      return 0;
    }

    This function is called by http_open(), line 225 from httpget.c, and
    passes "purl" and "httpauth1" as parameters. purl is a dinamic allocated
    variable and httpauth1 is a static (global) var with a fixed length of
    256. As you can see, getauthfromURL function copies the purl string, until
    a @ char, into httpauth1 without checking the length. It might be possible
    to exploit this to run arbitrary code. httpauth1 can overwrite some useful
    address and it is appended into a dynamic allocated variable (request)
    after a base64 encoding, overflowing this variable too.

    if (strlen(httpauth1) || httpauth) {
      char buf[1023];
      strcat (request,"Authorization: Basic ");
      if(strlen(httpauth1))
        encode64(httpauth1,buf);
      else
        encode64(httpauth,buf);
      strcat (request,buf); <-- HERE
      strcat (request,"\r\n");
    }

    Example:
    This vulnerability can be trigged locally by running:
    mpg123 -@ http://AAAAAAAAAAAAAA...AAAAA@www.somesite.com/somefile.xxx
    This can be exploited remotely via a crafted playlist with some file
    formatted as shown above hosted on a malicious web server.

    There is another buffer overflow in the function http_open. At line 245 of
    httpget.c,the prgName variable (mpg123 filename) is appended into the
    request variable:

    sprintf (request + strlen(request),
      " HTTP/1.0\r\nUser-Agent: %s/%s\r\n",
      prgName, prgVersion);

    The length of this variable is not checked, so one can create a specially
    crafted symlink to overflow the request variable. It is not a serious bug
    because it can be only exploited locally and mpg123 is not SUID by
    default.

    Disclosure Timeline:
    02/10/2004: Vulnerability detected.
    10/10/2004: Vendor contacted. No response.
    20/10/2004: Public announcement.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:barros@barrossecurity.com>
    Carlos Barros.
    The original article can be found at:
    <http://www.barrossecurity.com/advisories/mpg123_getauthfromurl_bof_advisory.txt> http://www.barrossecurity.com/advisories/mpg123_getauthfromurl_bof_advisory.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] Stp-Packet - Testing the Security of Spanning Tree Protocol"

    Relevant Pages