[Xitami] Imatix Xitami If-Modified-Since Remote Buffer OverflowVulnerability

[Maurilio Longo]

Pieter,

are there fully (by fully I mean with all the changes done over the years)
updated/patched sources on xitami site?

Thanks.

Maurilio.


Pieter Hintjens ha scritto:
> 
> On 10/2/07, Francis Turner <francis.turner at gmail.com> wrote:
> 
> > FWIW I can confirm that a perl ver of the explot code does kill my xitami
> 
> Sorry for not responding earlier, I missed the original exploit
> report.  Here is a patch that fixes the code (apply to sfl/sflmime.c):
> 
> Index: sflmime.c
> ===================================================================
> --- sflmime.c   (revision 10715)
> +++ sflmime.c   (working copy)
> @@ -285,7 +285,8 @@
>          min   = 0,
>          sec   = 0;
>      char
> -        month_name [20],
> +        mime_safe  [50],
> +        month_name [50],
>          buffer     [50],
>          *p_char;
> 
> @@ -293,9 +294,13 @@
>      ASSERT (date);
>      ASSERT (time);
> 
> +    /*  Copy input to safe string for security                               */
> +    strncpy (mime_safe, mime_string, 49);
> +    mime_safe [50] = 0;
> +
>      /*  Whatever format we're looking at, it will start with weekday.        */
>      /*  Skip to first space.                                                 */
> -    if (!(p_char = strchr (mime_string, ' ')))
> +    if (!(p_char = strchr (mime_safe, ' ')))
>          return FALSE;
>      else
>          while (isspace (*p_char))
> 
> --
> Pieter Hintjens
> iMatix Corporation
> 
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami

-- 
 __________                   
|  |  | |__| Maurilio Longo
|_|_|_|____| farmaconsult s.r.l.