USB driver bug exposed as "Linux plug&pwn"

J65nko · #1 **(View Single Post)** 8th March 2011

From http://www.h-online.com/security/new...n-1203617.html

Quote:

Rafael Dominguez Vega of MRW InfoSecurity has reported a bug in the Caiaq USB driver which could be used to gain control of a Linux system via a USB device.

The bug is caused by the device name being copied into a memory area with a size of 80 bytes using strcpy() without its length being tested. A crafted device with a long device name could thus write beyond the limits of this buffer, allowing it to inject and execute code.

BSDfan666 · #2 **(View Single Post)** 8th March 2011

OpenBSD uses strlcpy/strlcat/bcopy in their kernel, they did an audit for this a few years back.

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
How to replace "ectags" with "ctags"?	fender0107401	OpenBSD Packages and Ports	5	4 Weeks Ago 10:01 AM
Feasibility: "Load Balance Outgoing Traffic" with 2 NICs only	Tramboi	FreeBSD Security	3	29th April 2010 09:13 AM
Fixed "xinit" after _7 _8, "how" here in case anyones' "X" breaks... using "nvidia"	jb_daefo	Guides	0	5th October 2009 09:31 PM
"Thanks" and "Edit Tags".	diw	Feedback and Suggestions	2	28th March 2009 11:06 PM
Scripted sysinstall fails with "Command 'system' failed"	PeterSteele	FreeBSD Installation and Upgrading	0	13th November 2008 10:31 PM