Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:13895
HistoryAug 15, 2006 - 12:00 a.m.

Multiple buffer-overflows in libmusicbrainz 2.1.2

2006-08-1500:00:00
vulners.com
5

#######################################################################

                         Luigi Auriemma

Application: libmusicbrainz
http://musicbrainz.org/doc/libmusicbrainz
Versions: <= 2.1.2 and <= SVN 8406 (current SVN)
Platforms: Windows, *nix, *BSD, Mac and others
Bugs: A] buffer-overflow in MBHttp::Download
B] various buffer-overflows in rdfparse.c
Exploitation: remote
Date: 13 Aug 2006
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction

libmusicbrainz (aka mb_client) is an open source library used in many
multimedia programs for querying MusicBrainz servers.

#######################################################################

=======
2) Bugs


A] buffer-overflow in MBHttp::Download

A malicious MusicBrainz web server can exploit a buffer-overflow in the
Download function of the library through a big redirect HTTP reply
(Location).
This bug can be exploited also in other local ways since the problem is
located in the instructions which handle the URL's hostname.

>From lib/http.cpp:

Error MBHttp::Download(const string &url, const string &xml, bool fileDownload)
{
Error result = kError_InvalidParam;
char hostname[kMaxHostNameLen + 1];
char targethostname[kMaxHostNameLen + 1];
char proxyname[kMaxURLLen + 1];

const char ptr;
hostname[0] = 0;
numFields = sscanf(url.c_str(),
"http://%[^:/]:%hu", hostname, &port);
strcpy(targethostname, hostname);
ptr = strchr(url.c_str() + 7, '/');
file = string(ptr ? ptr : "");

// 3xx: Redirection - Further action must be taken in order to
// complete the request
case '3':
{
char
cp = strstr(buffer, "Location:");
//int32 length;

                if&#40;cp&#41;
                {
                    cp += 9;

                    if&#40;*cp == 0x20&#41;
                        cp++;

                    char *end;
                    for&#40;end = cp; end &lt; buffer + total; end++&#41;
                        if&#40;*end==&#39;&#92;r&#39; || *end == &#39;&#92;n&#39;&#41; break;

                    *end = 0x00;
                    ...
                        result = Download&#40;string&#40;cp&#41;, xml, fileDownload&#41;;
                    }
                    ...

B] various buffer-overflows in rdfparse.c

The instructions in lib/rdfparse.c which parse the RDF data received
from the server are affected by various buffer-overflows exploitable
with long URLs (like a big rdf:resource field) copied in buffers of 256
bytes.

For example in parse_uri the len parameter containing the size of
buffer (one of the base_buffer or reference_buffer buffers of 256 bytes
declared in resolve_uri_reference) is not checked so a long URI will
cause a buffer overflow.
The same function which calls parse_uri is affected by other buffer
overflows for the same reason, the length value is not verified.
Same problem for resolve_id and many other functions.

#######################################################################

===========
3) The Code

http://aluigi.org/poc/brainzbof.zip

usage examples:
A] nc -l -p 80 -v -v -n < brainzbof_a.txt
B] nc -l -p 80 -v -v -n < brainzbof_b.txt

#######################################################################

======
4) Fix

A new version will be released soon

#######################################################################


Luigi Auriemma
http://aluigi.org
http://mirror.aluigi.org