Melange聊天系统melange.conf配置行处理存在缓冲区溢出漏洞

漏洞信息详情

Melange聊天系统melange.conf配置行处理存在缓冲区溢出漏洞

• CNNVD编号：CNNVD-200207-035
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2002-0552
  
• 漏洞类型：
  
  
  边界条件错误
  
• 发布时间：
  
  2002-04-14
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2006-09-21
  
• 厂        商：
  
  melange
• 漏洞来源：
  Leon Harris※ leon@…

Melange是一款Christian Walter开发的聊天服务程序，当前程序作者已经没有对这个应用程序进行维护。
Melange在对melange.conf配置文件中的配置行内容缺少正确的边界检查，可导致缓冲溢出。
本地攻击者可以编译melange.conf配置文件，在配置文件中插入超长的一行内容就可以导致melange产生缓冲溢出，导致拒绝服务攻击，或以melange进程的权限执行任意指令。

临时解决方法：
如果您不能立刻安装补丁或者升级，CNNVD建议您采取以下措施以降低威胁：

没有合适的临时解决方法。
厂商补丁：
Christian Walter
—————-
Leon Harris (leon@quoll.com)提供如下补丁：

diff -Naur server/atool.c ../melange-2.02-beta2/server/atool.c

— server/atool.c Sat Jan 12 23:11:19 2002

+++ ../melange-2.02-beta2/server/atool.c Sun Dec 5 22:39:51 1999

@@ -94,7 +94,7 @@

strcpy(parameter,data);

#ifdef DEBUG

– snprintf(server.log.txt,sizeof(server.log.txt),”DEBUG (ATOOL): com: <%s> opt: <%s> par: <%s> at slot %d.\r\n”,command,option,parameter,sender);

+ sprintf(server.log.txt,”DEBUG (ATOOL): com: <%s> opt: <%s> par: <%s> at slot %d.\r\n”,command,option,parameter,sender);

util_WriteLog(LL_DEBUG);

#endif

diff -Naur server/auth.c ../melange-2.02-beta2/server/auth.c

— server/auth.c Sat Jan 12 23:11:19 2002

+++ ../melange-2.02-beta2/server/auth.c Sun Dec 5 22:40:10 1999

@@ -84,8 +84,6 @@

if (util_isSet(UNIQUENICKS)==YES) {

if ((util_isSet(GUESTLOGIN)==YES)&&(strcasecmp(client->name,”guest”)==0)) {

sprintf(salt,”%d%c”,mySlot,0);

– if (strlen(salt) + strlen(client->name) > sizeof(client->name))

– return(ERR_NAME);

strcat(client->name,salt);

}

else {

diff -Naur server/chatutil.c ../melange-2.02-beta2/server/chatutil.c

— server/chatutil.c Sat Jan 12 23:11:19 2002

+++ ../melange-2.02-beta2/server/chatutil.c Sun Dec 5 22:40:22 1999

@@ -64,7 +64,7 @@

sprintf(txt,MSG_LEAVE,slotID,slot[slotID].user->name);

comm_SendChannelBut(SYSMSG,myChannel,slotID,txt);

util_WriteMsgLog(txt);

– strncpy(server.log.txt,txt,sizeof(server.log.txt));

+ strcpy(server.log.txt,txt);

util_WriteLog(LL_NORMAL);

}

@@ -134,4 +134,4 @@

if (slot[mySlot].user!=NULL)

free(slot[mySlot].user);

slot[mySlot].user=NULL;

-}

+}

\ No newline at end of file

diff -Naur server/client.c ../melange-2.02-beta2/server/client.c

— server/client.c Sat Jan 12 23:11:19 2002

+++ ../melange-2.02-beta2/server/client.c Sun Dec 5 22:40:34 1999

@@ -175,9 +175,9 @@

if (util_GetNextSubString(inBuffer,cmd,MBUFFSIZE)!=OK)

if ((strlen(inBuffer)>0)&&(strlen(inBuffer)<(MBUFFSIZE-2)))

strcpy(cmd,inBuffer);

– util_GetNextSubString(inBuffer,name,sizeof(client->name));

– util_GetNextSubString(inBuffer,password,sizeof(client->passwd));

– util_GetNextSubString(inBuffer,channel,sizeof(client->channel));

+ util_GetNextSubString(inBuffer,name,MBUFFSIZE);

+ util_GetNextSubString(inBuffer,password,MBUFFSIZE);

+ util_GetNextSubString(inBuffer,channel,MBUFFSIZE);

if ((strlen(inBuffer)>0)&&(strlen(inBuffer)<(MBUFFSIZE-2)))

strcpy(group,inBuffer);

diff -Naur server/commands.c ../melange-2.02-beta2/server/commands.c

— server/commands.c Sat Jan 12 23:11:19 2002

+++ ../melange-2.02-beta2/server/commands.c Sun Dec 5 22:41:05 1999

@@ -135,7 +135,7 @@

int i;

char message[500];

– snprintf(message,sizeof(message),”%s “,message1);

+ sprintf(message,”%s “,message1);

if (strlen(message2)>0)

strcat(message,message2);

for (i=0;i(message);i++)>

@@ -513,7 +513,7 @@

}

}

sprintf(txt,MSG_NEWNAME,user,slot[user].user->name,myNewNick);

– strncpy(slot[user].user->name,myNewNick,sizeof(slot[user].user->name));

+ strcpy(slot[user].user->name,myNewNick);

comm_SendGroupBut(SYSMSG,user,txt);

sprintf(txt,MSG_YOURNEWNAME,myNewNick,user);

comm_SendTo(SYSMSG,user,txt);

diff -Naur server/interpret.c ../melange-2.02-beta2/server/interpret.c

— server/interpret.c Sat Jan 12 23:12:40 2002

+++ ../melange-2.02-beta2/server/interpret.c Sun Dec 5 22:41:41 1999

@@ -56,22 +56,22 @@

strcpy(data,util_FitString(data));

– if ( (strlen(data)<2) || (strlen(data) > 500 ) ) /* Can’t be a command ! */

+ if (strlen(data)<2) /* Can’t be a command ! */

return(ERR_ILLEGALCMD);

if (util_GetNextSubString(data,command,MBUFFSIZE)!=OK) /* Get command */

if ((strlen(data)>0)&&(strlen(data)<(MBUFFSIZE-2)))

– strncpy(command,data,sizeof(command));

+ strcpy(command,data);

if (util_GetNextSubString(data,option,MBUFFSIZE)!=OK) /* Get option */

if ((strlen(data)>0)&&(strlen(data)<(MBUFFSIZE-2)))

– strncpy(option,data,sizeof(option));

+ strcpy(option,data);

if ((strlen(data)>0)&&(strlen(data)<(MMAXTXTLEN-MBUFFSIZE))) /* Get parameter */

– strncpy(parameter,data,sizeof(parameter));

+ strcpy(parameter,data);

command[0]=’/’;

#ifdef DEBUG

– snprintf(server.log.txt,sizeof(server.log.txt),”DEBUG (User): com: <%s> opt: <%s> par: <%s> slot %d !\r\n”,command,option,parameter,sender);

+ sprintf(server.log.txt,”DEBUG (User): com: <%s> opt: <%s> par: <%s> slot %d !\r\n”,command,option,parameter,sender);

util_WriteLog(LL_DEBUG);

#endif

diff -Naur server/main.c ../melange-2.02-beta2/server/main.c

— server/main.c Sat Jan 12 23:11:19 2002

+++ ../melange-2.02-beta2/server/main.c Sun Dec 5 22:41:52 1999

@@ -49,12 +49,12 @@

printf (“%s(C) 1998,1999 by Christian Walter, All rights reserved\r\nhttp://melange.terminal.at” target=”_blank”>
http://melange.terminal.at Email: chris@terminal.at\r\n\n”,PRGVERSION);

server.port=PORT;

– strncpy(server.configFileName,CONFIGFILE,sizeof(server.configFileName));

+ strcpy(server.configFileName,CONFIGFILE);

for (i=1;i;i++)>

if ((strcasecmp(argv[i],”-p”)==0)&&((i+1)))>

server.port=atoi(argv[i+1]);

if ((strcasecmp(argv[i],”-c”)==0)&&((i+1)))>

– strncpy(server.configFileName,argv[i+1],sizeof(server.configFileName));

+ strcpy(server.configFileName,argv[i+1]);

}

util_ChatInit();

来源: XF
名称: melange-chat-config-bo(8845)
链接:http://www.iss.net/security_center/static/8845.php

来源: BID
名称: 4510
链接:http://www.securityfocus.com/bid/4510

来源: BID
名称: 4509
链接:http://www.securityfocus.com/bid/4509

来源: BID
名称: 4508
链接:http://www.securityfocus.com/bid/4508

来源: XF
名称: melange-chat-filename-bo(8846)
链接:http://www.iss.net/security_center/static/8846.php

来源: XF
名称: melange-chat-yell-bo(8842)
链接:http://www.iss.net/security_center/static/8842.php

来源: BUGTRAQ
名称: 20020416 Melange Chat POC DOS
链接:http://online.securityfocus.com/archive/1/267932

来源: BUGTRAQ
名称: 20020414 Vulnerabilities in the Melange Chat Server
链接:http://archives.neohapsis.com/archives/bugtraq/2002-04/0157.html