########## Luigi Auriemma Application: xtacacasd http://www.netplex-tech.com/software/xtacacsd Versions: <= 4.1.2 Platforms: *nix Bug: buffer-overflow in report() Exploitation: remote Date: 08 Jan 2008 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ########## 1) Introduction 2) Bug 3) The Code 4) Fix ########## =============== 1) Introduction =============== xtacacsd is an Unix TACACS server no longer supported. ########## ====== 2) Bug ====== From misc.c: #ifdef __STDC__ report (int priority, char *fmt, ...) #else report(priority, fmt, va_alist) int priority; char *fmt; va_dcl /* no terminating semi-colon */ #endif { char msg[256]; /* temporary string */ va_list ap; #ifdef __STDC__ va_start(ap, fmt); #else va_start(ap); #endif vsprintf (msg, fmt, ap); va_end(ap); ... ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/xtacacsdz.zip ########## ====== 4) Fix ====== No longer supported ##########