Rosiello Security - Eterm-LibAST Advisory

Advisory Content :

Eterm-LibAST Advisory

Rosiello Security
http://www.rosiello.org

I. BACKGROUND

Eterm (http://www.eterm.org) is a color vt102 terminal emulator intended as
an xterm(1) replacement. It is designed with a Freedom of Choice
philosophy, leaving as much power, flexibility, and freedom as possible in
the hands of the user. It is designed to look good and work well, but takes
a feature-rich approach rather than one of minimalism. Eterm uses Imlib for
advanced graphic abilities and includes LibAST.

II. DESCRIPTION

Eterm when builded links to LibAST. A stack overflow vulnerability exists
in LibAST that allows an attacker to execute commands with user group
?utmp?. The vulnerability is triggered when using an alternative
configuration file name by the '-X' option. In this case Eterm will call
conf_find_file() in conf.c from LibAST. Here is where vulnerability takes
place at:

if (dir) {

strcpy(name, dir);

strcat(name, "/");

strcat(name, file);

}

III. ANALISYS

By exploiting this vulnerability an attacker can gain control of the return
address of the executing function allowing arbitrary code execution with
"utmp" group privileges.

IV. DETECTION

All vulnerable versions of Eterm using LibAST prior to 0.7 are vulnerable.

V. WORKAROUND

Rosiello Security is currently unaware of any workaround for this issue.

VI. VENDOR RESPONSE

The vendor has released the following new package of LibAST to fix the
problem:

http://www.eterm.org/download/libast-0.7.tar.gz

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-0224 to this issue. This is a candidate for inclusion in the
CVE list (http://cve.mitre.org), which standardizes names for security
problems.

VIII. DISCLOSURE TIMELINE

15/01/2006 - Initial Vendor Contact

16/01/2006 ? Initial Vendor Response

23/01/2006 ? Coordinated public disclosure

IX. CREDITS

Johnny Mast from Rosiello Security (http://www.rosiello.org) is credited
with discovering this vulnerability.

Rosiello Security home page: http://www.rosiello.org

You can find Rosiello Security's members in our irc server:
irc.rosiello.net #rosiello

Visit our latest project Obsidis where you can find free security white
papers: http://www.obsidis.org

X. LEGAL NOTICES

Copyright © 2006 Rosiello Security

Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
Rosiello Security. If you wish to reprint the whole or any part of this
alert in any other medium other than electronically, please email angelo
(at) rosiello (dot) org [email concealed] for permission.

Disclaimer: The information in the advisory is believed to be accurate at
the time of publishing based on currently available information. Use of the
information constitutes acceptance for use in an AS IS condition. There are
no warranties with regard to this information. Neither the author nor the
publisher accepts any liability for any direct, indirect, or consequential
loss or damage arising from use of, or reliance on, this information.

Exploit: http://www.rosiello.org/archivio/eterm-exploit.c (Ubuntu with no
random stack)

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Rosiello Security - Eterm-LibAST Advisory