Vulnerability Note VU#249579

klogd does not adequately handle NULL byte when parsing text using LogLine( )

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=85478

II. Impact

The following workaround is taken from http://bugs.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=85478:
The patch below contains a possible fix for this, by treating a null byte as a delimiter, equivalent to \n. Additionally, the patch prevents LogLine from being invoked with a negative counter as an argument.

diff -u sysklogd-1.3.orig/klogd.c sysklogd-1.3/klogd.c
--- sysklogd-1.3.orig/klogd.c Sat Feb 10 13:04:06 2001
+++ sysklogd-1.3/klogd.c Sat Feb 10 12:58:11 2001
@@ -707,7 +707,7 @@
break; /* full line_buff or end of input buffer */
}

- if( *ptr == '\n' ) /* newline */
+ if( *ptr == '\n' || *ptr == '\0') /* newline or null terminator */
{
ptr++; /* skip newline */
space -= 1;
@@ -877,8 +877,10 @@
fprintf(stderr, "klogd: Error return from sys_sycall: " \
"%d - %s\n", errno, strerror(errno));
}
-
- LogLine(log_buffer, rdcnt);
+ else
+ LogLine(log_buffer, rdcnt);
+
+
return;
}

@@ -902,8 +904,8 @@
Syslog(LOG_ERR, "Cannot read proc file system: %d - %s.", \
errno, strerror(errno));
}
-
- LogLine(log_buffer, rdcnt);
+ else
+ LogLine(log_buffer, rdcnt);

return;
}

Systems Affected

http://bugs.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=85478
http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-026-01

Credit

This vulnerability was discovered by Thomas Roessler <roessler@does-not-exist.org> and was reported to the bugs.debian.org mailing list on February 10, 2001.

This document was written by Ian A. Finlay

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.