RE: Ethereal remote buffer overflow - addon

[LSS Security <exposed@xxxxxx>]

Just a little trick to overflow more stack memory in Ethereal.
It is possible to overflow stack with more than 255 - 2 bytes. If radius_len 
is set to 1, in strncpy() line it is subtracted by two and it will be -1 
(0xffffffff -> 4294967295 (unsigned long)).  

packet-3g-a11.c:
----------------
#define MAX_STRVAL 16
...
dissect_a11_radius( tvbuff_t *tvb, int offset, proto_tree *tree, int app_len)
{
...
  size_t     radius_len;
  ...
  guchar     str_val[MAX_STRVAL]; 
  ...
  radius_len = tvb_get_guint8(tvb, offset + 1);
  ...
  strncpy(str_val, tvb_get_ptr(tvb,offset+2,radius_len-2), radius_len-2); 
...
}
----------------


------------------------------------------
Leon Juranic, LSS Security
http://security.lss.hr

"Born under the lucky star magical,
but on this world generally tragical".
                                - Djole