exploitable function

exploitable function

[xlp]

hi, if this code is setuid root, is exploitable:

if(argc==2){
	        if(!strcmp("-show_release",argv[1]))
        {
                printf("%s\n", VERSION);
                exit(1);
        }
}

Re: exploitable function

[Elias Athanasopoulos]

On Tue, Jun 25, 2002 at 04:02:21PM -0500, xlp wrote:
> hi, if this code is setuid root, is exploitable:
> 
> if(argc==2){
> 	        if(!strcmp("-show_release",argv[1]))
>         {
>                 printf("%s\n", VERSION);
>                 exit(1);
>         }
> }

It's not. 

Elias

-- 
http://gnewtellium.sourceforge.net			MP3 is not a crime.	

Re: exploitable function

[Elias Athanasopoulos]

On Tue, Jun 25, 2002 at 04:33:29PM -0500, xlp wrote:

> anyway, it should no use strcmp, it should use strncmp ?

strcmp() compares, it doesn't copy stuff. It's quite safe.
> 
> by the way, where can i find a exploitable function and try to code epxloit proof for education and practice?

strcpy() is the number-one danger.

Elias

-- 
http://gnewtellium.sourceforge.net			MP3 is not a crime.	

Re: exploitable function

[Glynn Clements]

Elias Athanasopoulos wrote:

> > by the way, where can i find a exploitable function and try to
> > code epxloit proof for education and practice?
> 
> strcpy() is the number-one danger.

But note that strncpy() isn't much better, for two reasons:

1. If the source is longer than the size of the buffer, there won't be
a terminating NUL in the result.

2. If a string is too long, simply truncating it to a fixed length is
seldom the correct response, and may have security implications. It's
usually preferable to treat this situation as a fatal error, and
terminate the program.

-- 
Glynn Clements <glynn.clements@virgin.net>

Re: exploitable function

[Elias Athanasopoulos]

On Wed, Jun 26, 2002 at 08:26:03PM +0100, Glynn Clements wrote:
  
> But note that strncpy() isn't much better, for two reasons:
 
Yes. Better use strdup(). In binutils we use xstrdup() in most of
the cases and str[n]cpy() carefully.

Elias

-- 
http://gnewtellium.sourceforge.net			MP3 is not a crime.