[Xitami] Imatix Xitami If-Modified-Since Remote Buffer Overflow Vulnerability

[Pieter Hintjens]

On 10/2/07, Francis Turner <francis.turner at gmail.com> wrote:

> FWIW I can confirm that a perl ver of the explot code does kill my xitami

Sorry for not responding earlier, I missed the original exploit
report.  Here is a patch that fixes the code (apply to sfl/sflmime.c):

Index: sflmime.c
===================================================================
--- sflmime.c   (revision 10715)
+++ sflmime.c   (working copy)
@@ -285,7 +285,8 @@
         min   = 0,
         sec   = 0;
     char
-        month_name [20],
+        mime_safe  [50],
+        month_name [50],
         buffer     [50],
         *p_char;

@@ -293,9 +294,13 @@
     ASSERT (date);
     ASSERT (time);

+    /*  Copy input to safe string for security                               */
+    strncpy (mime_safe, mime_string, 49);
+    mime_safe [50] = 0;
+
     /*  Whatever format we're looking at, it will start with weekday.        */
     /*  Skip to first space.                                                 */
-    if (!(p_char = strchr (mime_string, ' ')))
+    if (!(p_char = strchr (mime_safe, ' ')))
         return FALSE;
     else
         while (isspace (*p_char))

--
Pieter Hintjens
iMatix Corporation