しゃある通信

---

#19-03 [hack,SECURITY]wget DoS exploit PoC

wget <= 1.10.2 (Unchecked Boundary Condition) Denial of Service Exploit

PoCにも書いてあるようにftp-basic.c:ftp_syst()でstrcasecmp()に渡すポインタのチェックしてないので、 チェックするように修正すればOK。

--- wget-1.10.2/src/ftp-basic.c.orig    2006-12-19 11:41:03.000000000 +0900
+++ wget-1.10.2/src/ftp-basic.c 2006-12-19 14:51:17.000000000 +0900
@@ -1038,6 +1038,10 @@
   /* Which system type has been reported (we are interested just in the
      first word of the server response)?  */
   request = strtok (NULL, " ");
+  if (!request) {
+    xfree (respline);
+    return FTPSRVERR;
+  }

   if (!strcasecmp (request, "VMS"))
     *server_type = ST_VMS;

まあstrtok()したときの返値は常にチェックしないとな。

---

---

© 2006 Kazuya 'Sharl' Masuda