[Dump-users] [Fwd: Linux dump strikes again]

[Bernhard E. <be...@be...>]

-------- Original Message --------
Subject: Linux dump strikes again
Date: Tue, 29 Feb 2000 16:19:15 -0800 (PST)
From: ve...@pi...
To: ama...@am...

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

For all you using linux dump, you may wish to examine this advisory.

Ian Turner

- ---------- Forwarded message ----------
Date: Mon, 28 Feb 2000 15:17:33 +0900
From: "±è¿ëÁØ KimYongJun (99Á¹¾÷)" <s9...@CE...>
To: BU...@SE...
Subject: [ Hackerslab bug_paper ] Linux dump buffer overflow

[ Hackerslab bug_paper ] Linux dump buffer overflow


File   :   /sbin/dump

SYSTEM :   Linux


INFO :


The problem occurs when it gets the argument.
It accepts the argument without checking out its length, and this causes
the problem.

It seems that this vulnerability also applies to RedHat Linux 6.2beta,
the latest version.


[loveyou@loveyou SOURCES]$ dump  -f a `perl -e 'print "x" x 556'`
  DUMP: Date of this level 0 dump: Mon Feb 28 14:45:01 2000
  DUMP: Date of last level  dump: the epoch
  DUMP: Dumping
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
to a
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:
ÆÄÀÏ À̸§ÀÌ ³Ê¹« ±é´Ï´Ù while opening filesystem
  DUMP: SIGSEGV: ABORTING!
Segmentation fault

[loveyou@loveyou SOURCES]$ dump  -f a `perl -e 'print "loveyou" x 556'`
  DUMP: SIGSEGV: ABORTING!
Segmentation fault    <=  occur ctime4()


How to fix
- ----------

patch :

[root@loveyou SOURCES]# diff -ru dump-0.4b13/dump/main_orig.c
dump-0.4b13/dump/main.c
- --- dump-0.4b13/dump/main_orig.c        Mon Feb 28 14:40:01 2000
+++ dump-0.4b13/dump/main.c     Mon Feb 28 14:40:57 2000
@@ -273,6 +273,9 @@
                exit(X_STARTUP);
        }
        disk = *argv++;
+        if ( strlen(disk) > 255 )
+           exit(X_STARTUP);
+
        argc--;
        if (argc >= 1) {
                (void)fprintf(stderr, "Unknown arguments to dump:");



hot fix :
it  is recommended that  the suid bit is
removed from dump using command :

    chmod a-s /sbin/dump




- - Yong-jun, Kim -
e - mail : lo...@ha...       s9...@ce...
homepage : http://www.hackerslab.org    http://ce.hannam.ac.kr/~s96192
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE4vGIGfn9ub9ZE1xoRAoA/AJ9cF2bJ/54bE8DIKxohksb490gW9wCgl8n/
WALe173AdzxWlZlOqaOG4zY=
=Uj8c
-----END PGP SIGNATURE-----