Bug#158637: [dendler@idefense.com: iDEFENSE Security Advisory: Linuxconf locally exploitable buffer overflow]

[Michael Banck <mbanck@gmx.net>]

tags 158637 + patch
thanks

As I stated, debian's linuxconf package should not be vulnerable, as it
is not installed setuid root.

Nevertheless, I've backported the patch from the latest upstream
version, which makes the exploit[1] fail even if you happen to set
linuxconf setuid root.

cheers,

Michael

-- 
http://www.securiteam.com/exploits/5CP0F0K8BW.html

diff -Naur linuxconf-1.28r3/translate/translat.cc linuxconf-1.28r4.orig/translate/translat.cc
--- linuxconf-1.28r3/translate/translat.cc	1999-12-13 04:18:48.000000000 +0100
+++ linuxconf-1.28r4.orig/translate/translat.cc	2002-08-19 20:45:48.000000000 +0200
@@ -85,6 +85,7 @@
 	}
 }
 static char *pterr = NULL;
+#define MAXERR_SIZE 2000
 /*
 	Print an error message and increment the err counter
 */
@@ -92,7 +93,7 @@
 {
 	va_list list;
 	va_start (list,msg);
-	pterr += vsprintf (pterr,msg,list);
+	pterr += vsnprintf (pterr,MAXERR_SIZE,msg,list);
 	va_end (list);
 }
 
@@ -196,13 +197,13 @@
 	Load the message dictionnary.
 	Terminate the application if any error.
 */
-int translat_load (
+static int translat_loaderr (
 	const char *basepath,	// Directory holding dictionnaries
 	const char *basename,	// base name of the dictionnary
 							// the language selection will supply
 							// the extension.
 	const char *lang,		// Suffix for the language
-	char *errmsg)			// Will contain the error message
+	char errmsg[MAXERR_SIZE])			// Will contain the error message
 {
 	int ret = -1;
 	errmsg[0] = '\0';
@@ -250,8 +251,8 @@
 							// the extension.
 	const char *lang)
 {
-	char errmsg[2000];
-	if (translat_load (basepath,basename,lang,errmsg)==-1){
+	char errmsg[MAXERR_SIZE];
+	if (translat_loaderr (basepath,basename,lang,errmsg)==-1){
 		fprintf (stderr,"%s",errmsg);
 		exit (-1);
 	}
@@ -298,10 +299,10 @@
 	}
 	const char *lang = deflang;
 	const char *lang_env = getenv(envlangvar);
-	if (lang_env != NULL) lang = lang_env;
+	if (lang_env != NULL && strlen(lang_env)<=5) lang = lang_env;
 
-	char errmsg[2000];
-	if (translat_load (basepath,basename,lang,errmsg)==-1){
+	char errmsg[MAXERR_SIZE];
+	if (translat_loaderr (basepath,basename,lang,errmsg)==-1){
 		if (strcmp(lang,"eng")!=0){
 			bool showerr = getenv ("SHOWDICERR")!=NULL;
 			if (showerr){