oss-sec mailing list archives
CVE Request: Planeshift buffer overflow
From: Andres Gomez <agomez () fluidsignal com>
Date: Thu, 17 May 2012 09:52:09 -0500
Name: Stack-based buffer overflow in Planeshift 0.5.9 and earlier Software: Planeshift 0.5.9 Software link: http://www.planeshift.it/ Vulnerability Type: Buffer overflow Vulnerability Details: There is a buffer overflow in planeshift/src/client/chatbubbles.cpp line 223: . . . // align csString align = chatNode->GetAttributeValue("align"); align.Downcase(); if (align == "right") chat.textSettings.align = ETA_RIGHT; else if (align == "center") chat.textSettings.align = ETA_CENTER; else chat.textSettings.align = ETA_LEFT; // prefix 223> strcpy(chat.effectPrefix, chatNode->GetAttributeValue("effectPrefix")); //enabled . . . this line reads a tag inside chatbubbles.xml called effectPrefix. If that string is very long, for example: <chat type="say" enabled="yes" colourR="186" colourG="168" colourB="126" shadowR="108" shadowG="98" shadowB="73" align="left" effectPrefix="chatbubble_AAAAA....AAAAA" /> It will overwrite effectPrefix[64] buffer, which can lead even to arbitrary code execution. Could a CVE be assigned to this issue? Thanks, Andres Gomez. -- -- AVISO DE CONFIDENCIALIDAD: Esta transmisión se entiende para uso del destinatario o la entidad a la que va dirigida y puede contener información confidencial o protegida por la ley. Si el lector de este mensaje no fuera el destinatario, considérese por este medio informado que la retención, difusión, o copia de este correo electrónico está estrictamente prohibida. Si recibe este mensaje por error, por favor notifique inmediatamente al emisor y destruya el original. Gracias -- CONFIDENTIALITY NOTICE: This transmission is intended for the use of the individual or entity to which it is addressed, and it may contain information that is confidential or privileged under law. If the reader of this message is not the intended recipient, you are hereby notified that retention, dissemination, distribution or copying of this e-mail is strictly prohibited. If you received this e-mail in error, please notify the sender immediately and destroy the original. Thank you.
Current thread:
- CVE Request: Planeshift buffer overflow Andres Gomez (May 17)
- Re: CVE Request: Planeshift buffer overflow Kurt Seifried (May 17)
- Re: CVE Request: Planeshift buffer overflow Andres Gomez (May 17)
- Re: CVE Request: Planeshift buffer overflow Kurt Seifried (May 17)
- Re: CVE Request: Planeshift buffer overflow Andres Gomez (May 17)
- Re: CVE Request: Planeshift buffer overflow Kurt Seifried (May 17)
- Re: CVE Request: Planeshift buffer overflow Andres Gomez (May 17)
- Re: CVE Request: Planeshift buffer overflow Kurt Seifried (May 17)