Project

General

Profile

Bug #2370

out-of-bounds read due to signedness error

Added by stbuehler over 4 years ago. Updated over 4 years ago.

Status:
Fixed
Priority:
Normal
Assignee:
-
Category:
-
Target version:
-
Start date:
2011-11-29
Due date:
% Done:

100%

Missing in 1.5.x:
No

Description

For http auth we need to base64-decode user input; the allowed character range
includes non ASCII characters above 0x7f.

The function to decode this string takes a "const char *in"; and reads
each character into an "int ch", which is used as offset in the table.

So characters above 0x80 lead to negative indices (as char is signed on most
platforms).

Here the vulnerable code (src/http_auth.c:67)

static const short base64_reverse_table[256] = ...;
static unsigned char * base64_decode(buffer *out, const char *in) {
    ...
    int ch, ...;
    size_t i;
    ...

        ch = in[i];
        ...
        ch = base64_reverse_table[ch];
    ...
}

It doesn't matter if "broken" data is read - it just may allow more
encodings of the correct login information.

The only possible impact is a segfault, leading to DoS.

I had a look at some debian and openSUSE binaryies, and it looks like
there is always enough data (>= 256 bytes) in the .rodata section before the
base64_reverse_table table, so these binaries are not vulnerable.

Thanks to Xi Wang who discovered the issue:
---
On 11/29/2011 12:42 AM, Xi Wang wrote:

Hi,

There's a potential integer overflow in base64_decode() at http_auth.c:108 (lighttpd-1.4.x HEAD).

// const char *in;
// int ch;

1) ch = in[i];
...
2) ch = base64_reverse_table[ch];

Note that the type of in[i] is signed char. At 1) ch could be negative, and at 2) base64_reverse_table[ch] is an out-of-bounds read.

To fix it, we could change the function signature
base64_decode(buffer *out, const char *in)
to
base64_decode(buffer *out, const unsigned char *in)

- xi

lighttpd-fix-base64-signedness.patch View (388 Bytes) stbuehler, 2011-11-29 14:05

Associated revisions

Revision 6c9dff7c (diff)
Added by stbuehler over 4 years ago

[mod_auth] Fix signedness error in http_auth (fixes #2370, CVE-2011-4362)

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2806 152afb58-edef-0310-8abb-c4023f1b3aa9

Revision 2806 (diff)
Added by stbuehler over 4 years ago

[mod_auth] Fix signedness error in http_auth (fixes #2370, CVE-2011-4362)

Revision 2807 (diff)
Added by stbuehler over 4 years ago

[mod_auth] Fix signedness error in http_auth (fixes #2370, CVE-2011-4362)

History

#1 Updated by stbuehler over 4 years ago

ch = (unsigned char) in[i]; should fix it; casting from unsigned char to int keeps the value positive (sizeof(int) > sizeof(char)).

#2 Updated by stbuehler over 4 years ago

  • Private changed from No to Yes

#3 Updated by stbuehler over 4 years ago

  • Project changed from internal to Lighttpd

#4 Updated by stbuehler over 4 years ago

  • Private changed from Yes to No
  • Missing in 1.5.x set to No

#5 Updated by stbuehler over 4 years ago

  • Status changed from New to Fixed
  • % Done changed from 0 to 100

Applied in changeset r2806.

Also available in: Atom