Date: Sun, 13 Aug 2006 17:59:15 +0200
From: Luigi Auriemma <aluigi@autistici.org.>
To: [email protected], [email protected],
Subject: Multiple buffer-overflows in libmusicbrainz 2.1.2
Message-Id: <20060813175915.03766bbb.aluigi@autistici.org.>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: antivirus-gw at tyumen.ru
#######################################################################
Luigi Auriemma
Application: libmusicbrainz
http://musicbrainz.org/doc/libmusicbrainz
Versions: <= 2.1.2 and <= SVN 8406 (current SVN)
Platforms: Windows, *nix, *BSD, Mac and others
Bugs: A] buffer-overflow in MBHttp::Download
B] various buffer-overflows in rdfparse.c
Exploitation: remote
Date: 13 Aug 2006
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org
#######################################################################
1) Introduction
2) Bugs
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
libmusicbrainz (aka mb_client) is an open source library used in many
multimedia programs for querying MusicBrainz servers.
#######################################################################
=======
2) Bugs
=======
--------------------------------------
A] buffer-overflow in MBHttp::Download
A malicious MusicBrainz web server can exploit a buffer-overflow in the
Download function of the library through a big redirect HTTP reply
(Location).
This bug can be exploited also in other local ways since the problem is
located in the instructions which handle the URL's hostname.
>From lib/http.cpp:
Error MBHttp::Download(const string &url, const string &xml, bool fileDownload)
{
Error result = kError_InvalidParam;
char hostname[kMaxHostNameLen + 1];
char targethostname[kMaxHostNameLen + 1];
char proxyname[kMaxURLLen + 1];
...
const char *ptr;
hostname[0] = 0;
numFields = sscanf(url.c_str(),
"http://%[^:/]:%hu", hostname, &port);
strcpy(targethostname, hostname);
ptr = strchr(url.c_str() + 7, '/');
file = string(ptr ? ptr : "");
...
// 3xx: Redirection - Further action must be taken in order to
// complete the request
case '3':
{
char* cp = strstr(buffer, "Location:");
//int32 length;
if(cp)
{
cp += 9;
if(*cp == 0x20)
cp++;
char *end;
for(end = cp; end < buffer + total; end++)
if(*end=='\r' || *end == '\n') break;
*end = 0x00;
...
result = Download(string(cp), xml, fileDownload);
}
...
-----------------------------------------
B] various buffer-overflows in rdfparse.c
The instructions in lib/rdfparse.c which parse the RDF data received
from the server are affected by various buffer-overflows exploitable
with long URLs (like a big rdf:resource field) copied in buffers of 256
bytes.
For example in parse_uri the len parameter containing the size of
buffer (one of the base_buffer or reference_buffer buffers of 256 bytes
declared in resolve_uri_reference) is not checked so a long URI will
cause a buffer overflow.
The same function which calls parse_uri is affected by other buffer
overflows for the same reason, the length value is not verified.
Same problem for resolve_id and many other functions.
#######################################################################
===========
3) The Code
===========
http://aluigi.org/poc/brainzbof.zip
usage examples:
A] nc -l -p 80 -v -v -n < brainzbof_a.txt
B] nc -l -p 80 -v -v -n < brainzbof_b.txt
#######################################################################
======
4) Fix
======
A new version will be released soon
#######################################################################
---
Luigi Auriemma
http://aluigi.org
http://mirror.aluigi.org
