[seanius at debian.org: Re: CVE-2006-2162: Buffer overflow in nagios]

[sean finney]

hey ethan (et al),

one of the debian security peeps brought to my attention another
possible issue with the Content-Length that might not be resolved
by the current patch.  what if someone sends a packet of size
INT_MAX or greater, causing an integer overflow?

	sean

----- Forwarded message from Sean Finney <seanius at debian.org> -----

Date: Thu, 11 May 2006 13:46:27 -0400
From: Sean Finney <seanius at debian.org>
To: Martin Schulze <joey at infodrom.org>
Subject: Re: CVE-2006-2162: Buffer overflow in nagios

hey joey,

On Thu, May 11, 2006 at 05:46:16PM +0200, Martin Schulze wrote:
> > - crafting a simple "user-agent" that can illustrate the vulnerability
> >   by sending a negative or 0 value for content length to a nagios cgi
> >   (it doesn't have to actually inject any shell code or anything, just
> >   PoC would be fine by me).
> 
> Why user-agent?  "All" you need to do is add some variables, so that

as a general rule i feel much more comfortable having some kind of PoC
code available that will tell me that my patch works.  granted, in this
case it's a rather straightforward patch, but still...

> the Content-Length is either exactly INT_MAX or even larger, both
> cause an integer overrun, which cause a negative malloc() which cause
> a situation in which the attacker may control some memory they shouldn't.

ah yes.. good point about INT_MAX.  i'll forward this upstream as well,
since i don't think ethan considered this.


	sean




----- End forwarded message -----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <https://www.monitoring-lists.org/archive/developers/attachments/20060511/d75dfc32/attachment.sig>