Vulnerability Report: Heap-Buffer-Overflow on Sharutils (unshar) 4.15.2

Path	csiph.com!goblin2!goblin1!goblin.stu.neva.ru!usenet.stanford.edu!not-for-mail
From	nafiez <nafiez.skins@gmail.com>
Newsgroups	gnu.utils.bug
Subject	Vulnerability Report: Heap-Buffer-Overflow on Sharutils (unshar) 4.15.2
Date	Wed, 21 Feb 2018 15:17:55 +0800
Lines	79
Approved	bug-gnu-utils@gnu.org
Message-ID	<mailman.9561.1519222136.27995.bug-gnu-utils@gnu.org> (permalink)
NNTP-Posting-Host	lists.gnu.org
Mime-Version	1.0
Content-Type	multipart/mixed; boundary="------------C0DA77C5BEFD055D8A444E39"
X-Trace	usenet.stanford.edu 1519222137 3055 208.118.235.17 (21 Feb 2018 14:08:57 GMT)
X-Complaints-To	action@cs.stanford.edu
To	bug-gnu-utils@gnu.org
Envelope-to	bug-gnu-utils@gnu.org
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=to:from:subject:message-id:date:user-agent:mime-version :content-language; bh=Q/nAIhzhOLAyDJYW112a+mM8ubmxT5mA5uK2ZBRvBzE=; b=j0oIXPDIp4Szqqy6vZUY7uTsuQYyYAri6AFzXWhW5yW/vEZ+8yXy27Rm94SQUmTw/3 LPkhzuubmtfZxN/NX+zb+D4GqIRDkJsZ2fMT4dmsuBcKWIr0DIo0HNFPnCLrOS1du4fI 23/Dxt0H+pELLZRVqhXbf8F2okT6zxMRkoZvMu87aLzIf3rFHWN79sfaVdHsg3DHLrM6 kqTzK8w2SGPYZ7iAOmNtEo0LJaHyjBQIDWtTn4WICemtlRwwTpcFOEGGSzCT2guiVST4 TiOD89GZ/CPXse1Mke+5l5rZ/C+zJxi0SXDMqQw8Pf+CKvQVz4yIt+ekJHX1+VrK8bLW G3IA==
X-Google-DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-language; bh=Q/nAIhzhOLAyDJYW112a+mM8ubmxT5mA5uK2ZBRvBzE=; b=fBEaFTDuPBwTLf91Xss5+zfQ4JWRbt7WsLG9Vcdzer+RHQoAOErx6u0axrN6t//t0r PUGUW2oKL4g60A2hN0Oq41wqDcdj4d01Y/tb5OI7s5qemQwRNzNtv7qKzutmHK1WRUiM G9fmC5adHfQYZYyjcz8pRG5R8kyODtH1wLhAREYxWeZGGlOqQXx7NREM/26e1e0THXU9 AVeCiWrXtNyoLmQ/YN2gVrfi8ibNPvxXLdmOBGe2HrycbW9S1ZPI0s22CJ7FA8FOvOX5 iNULKvaVMCl/Sgf+kF925HlSxSb5TsigviRvuSpTKyQ4wr1G6tsUswqJHGu9cP4oGEh9 Pn8Q==
X-Gm-Message-State	APf1xPALCauKsrm2bHG1RDdGhVAhyPE1QfJeeMT6MNFku4G29toBEJvB xyKcKqVNVX93ZPsBaryZc0clGbhG
X-Google-Smtp-Source	AH8x2242rIB40XldcHYivDLRIaYJ3/xVmnoftDjrysY98yTTeL6DAGmmdiAsuF7AQE3rTDx45v2hRA==
X-Received	by 10.107.140.86 with SMTP id o83mr2909027iod.127.1519197480492; Tue, 20 Feb 2018 23:18:00 -0800 (PST)
User-Agent	Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0
Content-Language	en-US
X-detected-operating-system	by eggs.gnu.org: Genre and OS details not recognized.
X-Received-From	2607:f8b0:4001:c06::233
X-Mailman-Approved-At	Wed, 21 Feb 2018 09:08:52 -0500
X-BeenThere	bug-gnu-utils@gnu.org
X-Mailman-Version	2.1.21
Precedence	list
List-Id	Bug reports for the GNU utilities <bug-gnu-utils.gnu.org>
List-Unsubscribe	<https://lists.gnu.org/mailman/options/bug-gnu-utils>, <mailto:bug-gnu-utils-request@gnu.org?subject=unsubscribe>
List-Archive	<http://lists.gnu.org/archive/html/bug-gnu-utils/>
List-Post	<mailto:bug-gnu-utils@gnu.org>
List-Help	<mailto:bug-gnu-utils-request@gnu.org?subject=help>
List-Subscribe	<https://lists.gnu.org/mailman/listinfo/bug-gnu-utils>, <mailto:bug-gnu-utils-request@gnu.org?subject=subscribe>
Xref	csiph.com gnu.utils.bug:2230

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi,

Another issue found was heap-buffer-overflow on Sharutils (unshar)
4.15.2. Attached is the fuzzed file.

Below are the ASAN output:

john@fuzzing:~/sharutils-4.15.2/src$ ./unshar
out/crashes/id:000000,sig:06,src:000005+000030,op:splice,rep:4
=================================================================
==11164==ERROR: AddressSanitizer: heap-buffer-overflow on address
0xb5901100 at pc 0x0804c695 bp 0xbfe86f28 sp 0xbfe86f18
READ of size 1 at 0xb5901100 thread T0
    #0 0x804c694 in looks_like_c_code
/home/john/sharutils-4.15.2/src/unshar.c:75
    #1 0x804c694 in find_archive
/home/john/sharutils-4.15.2/src/unshar.c:253
    #2 0x804c694 in unshar_file /home/john/sharutils-4.15.2/src/unshar.c:379
    #3 0x804a2f4 in validate_fname
/home/john/sharutils-4.15.2/src/unshar-opts.c:604
    #4 0x804a2f4 in main /home/john/sharutils-4.15.2/src/unshar-opts.c:639
    #5 0xb70ab636 in __libc_start_main
(/lib/i386-linux-gnu/libc.so.6+0x18636)
    #6 0x804ab95  (/home/john/sharutils-4.15.2/src/unshar+0x804ab95)

0xb5901100 is located 0 bytes to the right of 4096-byte region
[0xb5900100,0xb5901100)
allocated by thread T0 here:
    #0 0xb72dfdee in malloc (/usr/lib/i386-linux-gnu/libasan.so.2+0x96dee)
    #1 0x804c9e4 in init_unshar /home/john/sharutils-4.15.2/src/unshar.c:450
    #2 0xb70ab636 in __libc_start_main
(/lib/i386-linux-gnu/libc.so.6+0x18636)

SUMMARY: AddressSanitizer: heap-buffer-overflow
/home/john/sharutils-4.15.2/src/unshar.c:75 looks_like_c_code
Shadow bytes around the buggy address:
  0x36b201d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x36b201e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x36b201f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x36b20200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x36b20210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x36b20220:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b20230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b20240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b20250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b20260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36b20270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3

  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==11164==ABORTING

Thanks,

Nafiez

Back to gnu.utils.bug | Previous | Next | Find similar

Thread

Vulnerability Report: Heap-Buffer-Overflow on Sharutils (unshar) 4.15.2 nafiez <nafiez.skins@gmail.com> - 2018-02-21 15:17 +0800

csiph-web