#152 [CVE-2012-0698] DoS against tcsd

[Andy Lutomirski]

The attached python script will cause tcsd to segfault.

In general, there is a lot of input validation missing all over trousers.

If this isn't fixed soon, I'll probably disclose it somewhere else, too. In the mean time, I will notify some distros.

[Andy Lutomirski]

Exploit

[Andy Lutomirski]

I think that at least UnloadBlob_PCR_EVENT has a similar remotely exploitable bug.

[Andy Lutomirski]

This is CVE-2012-0698

[Rajiv Andrade]

Fix is on its way.

[Rajiv Andrade]

This commit solves the reported issue:

http://trousers.git.sourceforge.net/git/gitweb.cgi?p=trousers/trousers;a=commit;h=50dd06a6f639b76b3bb629606ef71b2dc5407601

I'll leave it open for now awaiting internal review and reporter's acknowledgment.

Thanks

[Rajiv Andrade]

By the way, none of these are 'exploitable', since the daemon runs unprivileged.

[Andy Lutomirski]

I may play around and see if I can still easily exploit it. I find this code to be rather scary.

[Kent Yoder]

Hi Andy, I'd be interested to hear of any more exploits you've found. Try 0.3.10, I've added a bit of hardening to it over 0.3.9. For now I'll close this bug but if you find anything please do reopen it.

Kent