Show HN: X11 desktop widget that shows location of your network peers on a map
1–10 of 90 posts
Re: Show HN: X11 desktop widget that shows location of your network peers on a map
#2[deleted]
Re: Show HN: X11 desktop widget that shows location of your network peers on a map
#3No basically secure:
char mapFilename[256]; strcat(strcpy(mapFilename, getenv("HOME")), RESOURCES); strcat(mapFilename, mapName);
Re: Show HN: X11 desktop widget that shows location of your network peers on a map
#4No basically secure: char mapFilename[256]; strcat(strcpy(mapFilename, getenv("HOME")), RESOURCES); strcat(mapFilename, mapName);
What's insecure? Can you explain what's the vulnerability here and how and by whom can it be exploited?
Re: Show HN: X11 desktop widget that shows location of your network peers on a map
#5That's a really neat idea, damn.
Re: Show HN: X11 desktop widget that shows location of your network peers on a map
#6No basically secure: char mapFilename[256]; strcat(strcpy(mapFilename, getenv("HOME")), RESOURCES); strcat(mapFilename, mapName);
What's insecure? Can you explain what's the vulnerability here and how and by whom can it be exploited?
Assuming that code is actually present in your app, env vars can hold more than 255 characters. Easy buffer overflow to trigger. Use length-bounded copies and concats...
That's just off the top of my head; I've not written in C in a while.
Re: Show HN: X11 desktop widget that shows location of your network peers on a map
#7Re: Show HN: X11 desktop widget that shows location of your network peers on a map
#8No basically secure: char mapFilename[256]; strcat(strcpy(mapFilename, getenv("HOME")), RESOURCES); strcat(mapFilename, mapName);
What's insecure? Can you explain what's the vulnerability here and how and by whom can it be exploited?
Basically, any path longer than 256 characters for `mapFilename` would cause a buffer overrun.
An unprivileged app could run your app (say, with more privileges), with a very long `HOME` environment path, causing a buffer overflow, and potentially exploit it to use your app's privileges to do more stuff than it was supposed to.
Basically, you should never use strcpy and strcat and but use the secure alternatives like strcpy_s and strcat_s, even when you know the source buffer would never exceed the destination size.
Re: Show HN: X11 desktop widget that shows location of your network peers on a map
#9Earlier quoted context omitted.
What's insecure? Can you explain what's the vulnerability here and how and by whom can it be exploited?
Assuming that code is actually present in your app, env vars can hold more than 255 characters. Easy buffer overflow to trigger. Use length-bounded copies and concats... That's just off the top of my head; I've not written in C in a while.
Why would you want to trigger a buffer overflow in user application if you can already control HOME envvar?
Re: Show HN: X11 desktop widget that shows location of your network peers on a map
#10Earlier quoted context omitted.
What's insecure? Can you explain what's the vulnerability here and how and by whom can it be exploited?
Basically, any path longer than 256 characters for `mapFilename` would cause a buffer overrun. An unprivileged app could run your app (say, with more privileges), with a very long `HOME` environment path, causing a buffer overflow, and potentially exploit it to use your app's privileges to do more stuff than it was supposed to. Basically, you should never use strcpy and strcat and but use the secure alternatives like…
> (say, with more privileges)
Isn't it a moot point if unprivileged app can already run anything with more privileges? In normal operation, connmap requires no special privileges.