[SNS Advisory No.32] w3m malformed MIME header Buffer Overflow Vulnerability

["snsadv () lac co jp" <snsadv () lac co jp>]

-----------------------------------------------------------------------
SNS Advisory No.32
w3m malformed MIME header Buffer Overflow Vulnerability

Problem first discovered: Thu, 25 May 2001
Published: Wed, 19 Jun 2001
Last Updated: Wed, 19 Jun 2001 
----------------------------------------------------------------------

Overview
--------
        w3m, a text file/Web browser which is similar to lynx, has
a buffer overflow vulnerability in a routine to parse MIME header.
If a user retrieves/downloads a malformed Web page with w3m, 
a malicious Web server administrator may gain an escalated
privilege from the w3m user, which is run by w3m remotely.

Problem Description
-------------------

        w3m handles MIME header included in the request/response
massage within the HTTP session like other web browsers.
A buffer overflow will be occuerred when w3m accept MIME encoded
header with a base 64 format. The length of encoded header must
be over 34 characters.
The following are a memory dump and contents of register
when a buffer overflow is occurred.

  MIME header:
        =?AAAAAAAAAAAAAA(50 'A' characters in the header)AAAAAAAA?=

  memory dump:
　0xbffff8a0: 0x41414141 0x41414141 0x41414141 0x41414141
　0xbffff8b0: 0x41414141 0x41414141 0x41414141 0x41414141
　0xbffff8c0: 0x41414141 0x41414141 0x41414141 0x41414141
　0xbffff8d0: 0xbf0a4141 0x080e0000 0x00000001 0x080792c3

  register:
　ESP:          0xbffff8d0
　EIP:          0x41414141

        If a remote Web administrator (a remote attacker) could embed
codes in the 0x41 part and control the EIP, it is possible to execute
arbitrary codes in the privilege of w3m user.

Tested Version
--------------
　w3m 0.2.1

Tested OS
---------
　RedHat 7.0J
  Solaris 7 (x86)

Patch Information
-----------------
        A patch to fix this issue is announced from a developer's
mailing list of w3m.

A patch to fix this issue[Archive number 2066]:
        http://mi.med.tohoku.ac.jp/~satodai/w3m-dev/200106.month/2066.html
A recommendation to clean up #2066:
        http://mi.med.tohoku.ac.jp/~satodai/w3m-dev/200106.month/2067.html

Discovered by
-------------

OGASAWARA Satoshi   (LAC / s.ogaswr () lac co jp)
KOBAYASHI Shigehiro (LAC / sigehiro () lac co jp)

Disclaimer
----------
All information in this advisories are subject to change without any 
advanced notices neither mutual consensus, and each of them is released
as it is. LAC Co.,Ltd. is not responsible for any risks of occurrences
caused by applying those information.

References
----------
w3m official page(English):
        http://ei5nazha.yz.yamagata-u.ac.jp/~aito/w3m/eng/index.html

w3m official page(Japanese):
        http://ei5nazha.yz.yamagata-u.ac.jp/~aito/w3m/index.html

Archive of this advisory:
        http://www.lac.co.jp/security/english/snsadv_e/32_e.html

SNS Advisory:
        http://www.lac.co.jp/security/english/snsadv_e/

LAC:
        http://www.lac.co.jp/security/english/

------------------------------------------------------------------
Secure Net Service(SNS) Security Advisory <snsadv () lac co jp>
Computer Security Laboratory, LAC  http://www.lac.co.jp/security/