8 Apr
2003
8 Apr
'03
11:48 a.m.
On 08 Apr 2003 10:40:30 +0530 Trevor Warren wrote:
o Problem description: An anonymous user can gain remote root access due to a buffer overflow caused by a StrnCpy() into a char array (fname) using a non-constant length (namelen).
StrnCpy(fname,pname,namelen); /* Line 252 of smbd/trans2.c */
In the call_trans2open function in trans2.c, the Samba StrnCpy function copies pname into fname using namelen. The variable namelen is assigned the value of strlen(pname)+1, which causes the overflow.
^^^^^^^^^^^^^
Just to highlight a bad practice that gives false sense of security :)
--
Tahir Hashmi
http://staff.ncst.ernet.in/tahir
Compact XML Alternative - http://xqueeze.sf.net