0

Consider following C code snippet:

void barfoo (int authstatus) {
    char packet[1024];

    fgets (packet, 1023, stdin);
    if (authstatus != 0)
       system (packet);
    else
       syslog ("Not authorised to process packet");

    return;
}

Attacker can only call this function with auth_status set to 0. Goal of the attacker is to execute code of his choice like spawn a shell. So, can attacker do this in any way if he has to exploit only this function or any function directly related to this function like fgets or system or syslog?

I am unable to find any vulnerability in this. For instance fgets checks for bounds so buffer overflow is not possible.

11
  • Are you excluding local attacks like rowhammer? – wireghoul Nov 9 '20 at 11:31
  • Actually this is asked in an exam of graduate level Systems security course. And we are only familiar with stack based buffer overflow, format string exploits, return to lib c attacks, basic heap based buffer overflow. Sorry I am not familiar with what you mentioned. – Vimal Patel Nov 9 '20 at 11:44
  • I asked about this to my prof. But he said me to think about this. But I have spent much of my time and still I strongly think that this code is not vulnerable. – Vimal Patel Nov 9 '20 at 11:46
  • 2
    Let us know if your instructor gives you the answer, since it seems we can't find anything either based on the provided information. – multithr3at3d Nov 9 '20 at 23:35
  • 2
    @multithr3at3d, Today my professor discussed this question and we came to know that question was ambiguous as he was assuming that authstatus is 1 which is not mentioned anywhere. Now, I'm feeling sorry for posting this question here. – Vimal Patel Nov 16 '20 at 16:17
2

Your question is:

can attacker do this in any way if he has to exploit only this function or any function directly related to this function like fgets or system or syslog?

And you said in a comment:

we are only familiar with stack based buffer overflow, format string exploits, return to lib c attacks, basic heap based buffer overflow.

So hardware flaws are not within the scope of this question.

I assume that when you say auth_status, you actually mean authstatus.

In that case, I agree with you: No, this code is not vulnerable.

I did find one potential vulnerability: calling fgets() to read some bytes from stdin would affect what happens next time you read stdin. In particular, it would affect what happens next time you call barfoo() (possibly with a different value of authstatus). But this seems like overthinking it, since you said:

there is no other relevant code besides this

3
  • The thing I wonder about, why call in the buffer if your not authenticated... this would potentially open up a flow in the fgets functionality. (e.a. do not open the buffer if not going to process it) – LvB Nov 9 '20 at 13:46
  • 1
    I don’t see any reports of known flaws in fgets(), and unknown flaws are outside the scope of this question. But I agree, the code should not do anything if the user is not authenticated. In fact, this function should not be called to begin with if the user is not authenticated (there’s been some sort of security check done already, since we are guaranteed that an attacker’s authstatus is 0). But the OP didn’t write this code, so let’s not spend too much time worrying about whether it’s well-written. – Brian Drake Nov 9 '20 at 14:00
  • It’s a comment for a reason @BrianDrake. I am only aware of fgets flaws on some embedded systems (which are also out of scope), for the rest I completely agree (which is why I made the comment). Just remember that “C” is not as clearly defined as we sometimes think it is.... – LvB Nov 9 '20 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.