rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist()

rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR strings into a fixed 128-byte stack buffer with sprintf(). A malicious or on-path rpcbind server overflows it when a user runs:
rpcinfo -l <host> <prognum> <versnum>

Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com>
Signed-off-by: Steve Dickson <steved@redhat.com>

diff --git a/src/rpcinfo.c b/src/rpcinfo.c
index c59e8b4..30d535e 100644 (file)
--- a/src/rpcinfo.c
+++ b/src/rpcinfo.c
@@ -1104,7 +1104,7 @@ rpcbaddrlist (
 
          re = &head->rpcb_entry_map;
          printf ("%10u%3u    ", parms.r_prog, parms.r_vers);
-         sprintf (buf, "%s/%s/%s ",
+         snprintf (buf, sizeof(buf), "%s/%s/%s ",
                   re->r_nc_protofmly, re->r_nc_proto,
                   re->r_nc_semantics == NC_TPI_CLTS ? "clts" :
                   re->r_nc_semantics == NC_TPI_COTS ? "cots" : "cots_ord");