webfsd fun. opensource is god .lol windows

[yan feng <jsk@xxxxxxxxxxx>]

                          webfsd fun. opensource is god .lol windows


                                pst.security advisory 2005-2-20


Systems affected:
unstable webfsd 1.21
stable wenfsd 1.17.2


no affected


no..all remote exploitable



1:  why advisory?  this bug is found two years ago ,yeach, debian   and webfsd 
coder can't path this   hehe...:P   it is no problem...  this  is not power 
...so pub it


2:  Description:
all webfsd can be remote exploit easily by writeable dir...

see gdb ..:P

problem  is in ls.c....   i don't want to path it..hehe 


static char* 
ls(time_t now, char *hostname, char *filename, char *path, int *length)
{
    DIR            *dir;
    struct dirent  *file;
    struct myfile  **files = NULL;
    struct myfile  **re1;
    char           *h1,*h2,*re2,*buf = NULL;
    int            count,len,size,i,uid,gid;
    char           line[1024];
    char           *pw = NULL, *gr = NULL;

    if (debug)
        fprintf(stderr,"dir: reading %s\n",filename);
    if (NULL == (dir = opendir(filename)))
        return NULL;

    /* read dir */
    uid = getuid();
    gid = getgid();
    for (count = 0;; count++) {
        if (NULL == (file = readdir(dir)))
            break;
        if (0 == strcmp(file->d_name,".")) {
            /* skip the the "." directory */
            count--;
            continue;
        }
        if (0 == strcmp(path,"/") && 0 == strcmp(file->d_name,"..")) {
            /* skip the ".." directory in root dir */
            count--;
            continue;
        }

        if (0 == (count % 64)) {
            re1 = realloc(files,(count+64)*sizeof(struct myfile*));.....  it is 
not good code tips.:P
            if (NULL == re1)
                goto oom;
            files = re1;
        }

        files[count] = malloc(strlen(file->d_name)+sizeof(struct myfile));
        if (NULL == files[count])
            goto oom;
        strcpy(files[count]->n,file->d_name);......:P
        sprintf(line,"%s/%s",filename,file->d_name);   .....:P
        if (-1 == stat(line,&files[count]->s)) {
            free(files[count]);
            count--;
            continue;
        }



..................................................

gdb it

Program received signal SIGSEGV, Segmentation fault.
0x4009c5eb in strlen () from /lib/libc.so.6
(gdb) bt
#0  0x4009c5eb in strlen () from /lib/libc.so.6
#1  0x4006ea53 in vfprintf () from /lib/libc.so.6
#2  0x4008866b in vsprintf () from /lib/libc.so.6
#3  0x4007632d in sprintf () from /lib/libc.so.6
#4  0x0804df44 in ls (now=1094795585, hostname=0x41414141 "",
    filename=0x41414141 "", path=0x41414141 "", length=0x41414141) at ls.c:254
#5  0x41414141 in ?? ()
#6  0x41414141 in ?? ()
#7  0x41414141 in ?? ()
#8  0x41414141 in ?? ()
#9  0x41414141 in ?? ()

....................................................

i sent a mail to kraxel@xxxxxxxxxxx   (2004. 2.6)

but I don't receive reply ...so ...  



2003 I have do another an working exploit for this bug..



easy to gain  ....



webfsd : i use it to upload movies.... it is clear  and fast.. 




^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
resol..

 webfsd new version(:P)

http://linux.bytesex.org/misc/webfs.html     


I don't like go to work... but i have to do it..