|
Brought to you by:
Suppliers of:
|
|
|
| |
| GNU Chess lets most modern computers play a full game of chess. A security vulnerability in the product allows execution of arbitrary code, due to a buffer overflow vulnerability in the product. |
| |
Credit:
The information has been provided by Bernhard Kuemel.
|
| |
Vulnerable systems:
GNU Chess versions prior to 5.03beta
Immune systems:
GNU Chess version 5.03beta
GNU Chess contains a buffer overflow vulnerability that may lead to arbitrary command execution if an attacker is permitted to send commands to GNU Chess remotely via the Internet.
Example:
$ gdb ./gnuchess
(gdb) run
Starting program: /usr/src/gnuchess/./gnuchess
GNU Chess v5.02
Transposition table: Entries=1024K Size=32768K Pawn hash table: Entries=384K Size=18432K White (1) : AAAAAAAAAAAAAAA1234567890
Program received signal SIGSEGV, Segmentation fault. 0x35343332 in ?? ()
Vulnerable code:
In file cmd.c:
65 void InputCmd ()
66 /*************************************************************************
67 *
68 * This is the main user command interface driver.
69 *
70 ***********************************************************************
477 /* everything else must be a move */
(Or e.g. malicious input)
478 else
479 {
480 ptr = ValidateMove (cmd);
In file move.c:
500 leaf * ValidateMove (char *s)
501 /*************************************************************************
502 *
503 * This routine takes a string and check to see if it is a legal move.
504 * Note. At the moment, we accept 2 types of moves notation.
505 * 1. e2e4 format. 2. SAN format. (e4)
506 *
507 ***********************************************************************
508 {
509 short f, t, side, rank, file, fileto;
510 short piece, kount;
This is the reason for the overflow:
511 char mvstr[10], *p;
^^
512 BitBoard b;
513 leaf *n1, *n2;
514
524 p = mvstr;
525 do
526 {
527 if (*s != 'x' && *s != '+' && *s != '=')
The overflow happens here:
528 *p++ = *s;
^^^^^^^^^^
529 } while (*s++ != '\0');
You may eliminate the vulnerability by defining
511 char mvstr[64], *p;
Since you limit the input to 64 bytes in cmd.c:
120 if (fgets (inputstr, 64, stdin) && inputstr[0])
121 inputstr[strlen(inputstr)-1] = '\000';
|
|
|
|
|
