AOH :: HP Unsorted N :: BX3421.HTM

NASA BigView Stack Buffer Overflow



CORE-2008-0425 - NASA BigView Stack Buffer Overflow
CORE-2008-0425 - NASA BigView Stack Buffer Overflow



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

      Core Security Technologies - CoreLabs Advisory
http://www.coresecurity.com/corelabs/ 

           NASA BigView Stack Buffer Overflow


*Advisory Information*

Title: NASA BigView Stack Buffer Overflow
Advisory ID: CORE-2008-0425
Advisory URL: http://www.coresecurity.com/?action=item&id=2304 
Date published: 2008-06-04
Date of last update: 2008-06-03
Vendors contacted: NASA Ames Research Center
Release mode: Coordinated release


*Vulnerability Information*

Class: Stack Overflow
Remotely Exploitable: Yes (client side)
Locally Exploitable: No
Bugtraq ID: 29517	
CVE Name: CVE-2008-2542	


*Vulnerability Description*

NASA BigView [1] allows for interactive panning and zooming of images of
arbitrary size on desktop PCs running Linux. Using this software, one
can explore (on relatively modest machines) images such as the Mars
Orbiter Camera mosaic [92160x33280 pixels].

The BigView package suffers from a stack buffer overflow when parsing
specially crafted (invalid) PNM input files. If successful, a malicious
third party could trigger execution of arbitrary code within the context
of the application, or otherwise crash the whole application. The
vulnerability is caused due to the BigView package not properly checking
the line length of the ascii PNM input files before copying it on a
stack buffer. This can be exploited to get arbitrary code execution by
opening a specially crafted file.

Exploitation of the PNM overflow problem requires the user to explicitly
open a malicious file. The user should refrain from opening files from
untrusted third parties or accessing untrusted Web sites until the patch
is applied.


*Vulnerable Packages*

. BigView revision 1.8.
. Older BigView versions could be affected too, but they were not tested.


*Non-vulnerable Packages*

. Available through BigView website (since June 2nd 2008, see below).


*Vendor Information, Solutions and Workarounds*

The NASA BigView team has published a new version fixing this
vulnerability. The tarball is available on BigView's website:
http://opensource.arc.nasa.gov/project/bigview/ 


*Credits*

This vulnerability was discovered and researched by Alfredo Ortega, from
CORE IMPACT's Exploit Writing Team (EWT), Core Security Technologies.


*Technical Description / Proof of Concept Code*

The BigView package suffers from a stack buffer overflow when parsing
specially crafted (invalid) PNM input files. If successful, a malicious
third party could trigger execution of arbitrary code within the context
of the application, or otherwise crash the whole application.

The vulnerability resides in the following code at 'Ppm/ppm.C'. Here,
the function 'getline()' reads data from a file into a buffer. This is
the complete function:

/-----------

418 static void getline(int fin, char* lineBuf, int len)
419 {
420   bool done=false;
421   int index=0;
422   lineBuf[index]=' ';
423   while(! done){
424     lineBuf[index] = getOneChar(fin);
425     if( lineBuf[index]==10 ) {
426       lineBuf[index]=0;
427       done=true;
428     }
429     ++index;
430   }
431   lineBuf[index]=0;
432 }

- -----------/

Clearly the function requires the length of the destination buffer, but
it is never used internally. This function is used on the
'PPM::ppmHeader()' function, to read the header of the PPM file.

/-----------

56  PPM::ppmHeader(string filename, PPM::Format* format,
57                 int* cpp, int* bpc,
58                 int* sizeX, int* sizeY,
59                 int* imageOffset)
60  {
61    std::ostringstream err;
62    char magic[3],lineBuf[512],junk;
63    int res,max;
.
.
.
115   while( junk == '#' ){
116     getline(fin,lineBuf,512);
117     cout << "Comment:"<http://opensource.arc.nasa.gov/project/bigview/ 


*About CoreLabs*

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://www.coresecurity.com/corelabs/. 


*About Core Security Technologies*

Core Security Technologies develops strategic solutions that help
security-conscious organizations worldwide develop and maintain a
proactive process for securing their networks. The company's flagship
product, CORE IMPACT, is the most comprehensive product for performing
enterprise security assurance testing. CORE IMPACT evaluates network,
endpoint and end-user vulnerabilities and identifies what resources are
exposed. It enables organizations to determine if current security
investments are detecting and preventing attacks. Core Security
Technologies augments its leading technology solution with world-class
security consulting services, including penetration testing and software
security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core
Security Technologies can be reached at 617-399-6980 or on the Web at
http://www.coresecurity.com. 


*Disclaimer*

The contents of this advisory are copyright (c) 2008 Core Security
Technologies and (c) 2008 CoreLabs, and may be distributed freely
provided that no fee is charged for this distribution and proper credit
is given.


*GPG/PGP Keys*

This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc. 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org 

iD8DBQFIRu4lyNibggitWa0RAljKAJ4iVfRGNB6Hz+tA6DKFqpovws/cwACfSBFF
a9ffEcKqAre7M1jXT9OpHOg=UCFz
-----END PGP SIGNATURE-----

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.