|
|
|
|
| |
| The DSH package has been found to contain a buffer overflow in the HOME environment variable. This vulnerability will allow attackers to cause the product crash. |
| |
Credit:
The information has been provided by jsk.
|
| |
Vulnerable systems:
* DSH version 0.24.0
Vulnerable code:
Inside dsh.c:
main(int ac, char ** av)
{
char *buf=NULL;
setlocale (LC_ALL, "");
if (!textdomain(PACKAGE_NAME))
{
if (!bindtextdomain(PACKAGE_NAME, LOCALEDIR))
fprintf (stderr, "%s: failed to call bindtextdomain\n", PACKAGE);
}
load_configfile(DSH_CONF);
if (asprintf (&buf, "%s/.dsh/dsh.conf", getenv("HOME")) < 0).............lol
{
fprintf (stderr, _("%s: asprintf failed\n"), PACKAGE);
exit (1);
}
load_configfile(buf);
free (buf);
asprintf???????
nt asprintf(char **strp, const char *fmt, ...)
{
ssize_t buflen = 50 * strlen(fmt); /* pick a number, any number */.............lol
*strp = malloc(buflen);
if (*strp)
{
va_list ap;
va_start(ap, fmt);
vsnprintf(*strp, buflen, fmt, ap);..................................lol
va_end(ap);
return buflen;
}
|
|
|
|
|
