In any case, I've changed this in cvs so as to avoid setting off any future false-alarms. ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Neulinger, Nathan > Sent: Wednesday, April 23, 2003 11:59 AM > To: b0f www.b0f.net; bugtraq@securityfocus.com > Cc: cgiwrap-users@lists.sourceforge.net > Subject: [cgiwrap-users] RE: Format strings vuln in CGIwrap > > > This is not a security problem. This is a case of using an automated > tool to find these vulnerabilites and not attempting to understand the > code itself. > > Nowhere in the code is MSG_Error_General() passed anything > other than a > static compiled-into-the-executable string. It's purely a utility > function to wrap common error text/footer/etc. around a > generic string. > > -- Nathan > > ------------------------------------------------------------ > Nathan Neulinger EMail: nneul@umr.edu > University of Missouri - Rolla Phone: (573) 341-4841 > Computing Services Fax: (573) 341-4216 > > > > -----Original Message----- > > From: security-bounces+nneul=umr.edu@lists.umr.edu > > [mailto:security-bounces+nneul=umr.edu@lists.umr.edu] On > > Behalf Of b0f www.b0f.net > > Sent: Wednesday, April 23, 2003 11:06 AM > > To: bugtraq@securityfocus.com > > Subject: Format strings vuln in CGIwrap > > > > > > > > > > A locally and possibly remotely exploitable format > > strings bug exists > > in cgiwrap available from > > http://cgiwrap.sourceforge.net/ > > http://sourceforge.net/projects/cgiwrap > > http://www.freebsd.org/ports/security.html > > > > I. BACKGROUND > > > > This is CGIWrap - a gateway that allows more secure > > user access to > > CGI programs on an HTTPd server than is provided by the > > http server > > itself. The primary function of CGIWrap is to make > > certain that > > any CGI script runs with the permissions of the user > > who installed > > it, and not those of the server. > > > > CGIWrap works with NCSA httpd, Apache, CERN httpd, > > NetSite Commerce > > and Communications servers, and probably any other Unix > > based web > > server software that supports CGI. > > > > II. DESCRIPTION > > > > On line 91 of msgs.c the printf() function is used > > incorrectly. Which > > results > > in a format strings vulnerability. > > <snip> > > void MSG_Error_General(char *message) > > { > > MSG_Header("CGIWrap Error", message); > > printf(message); > > MSG_Footer(); > > exit(1); > > } > > </snip> > > > > The binaries in cgiwrap, (cgiwrap and nph-cgiwrap) are > > installed setuid > > root. > > Thus could make this format problem exploitable locally > > to gain root > > privs or > > possably remotely to gain root or the privs of the user > > who owns the cgi > > script. > > > > III. ANALYSIS > > An attacker could exploit this issue to escalate privs > > locally or > > remotely on > > a server running cgiwrap. > > > > IV. DETECTION > > > > This is vulnerable in the latest version of cgiwrap > > version 3.7.1 and > > properly > > older versions(not checked). It would be exploitable on > > any Linux/Unix > > based OS > > running cgiwrap > > > > V. VENDOR > > The vendor has not been contacted about this issue. > > > > Regards > > b0f (Alan M) > > www.b0f.net > > _______________________________________________ > > UMR Security List Exploder > > security@lists.umr.edu > > https://lists.umr.edu/mailman/listinfo/security > > > > > ------------------------------------------------------- > This sf.net email is sponsored by:ThinkGeek > Welcome to geek heaven. > http://thinkgeek.com/sf > _______________________________________________ > cgiwrap-users mailing list > cgiwrap-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/cgiwrap-users >
