#919696 libmemcached: [libmemcached] Missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS response handling

Package:
libmemcached
Source:
libmemcached
Submitter:
Ioanna Alifieraki
Date:
2021-04-23 23:45:02 UTC
Severity:
normal
Tags:
#919696#5
Date:
2019-01-18 16:52:18 UTC
From:
To:
Dear Maintainer,

When connecting to a server using SASL, memcached_sasl_authenticate_connection() reads the list of
supported mechanisms from the server via the command PROTOCOL_BINARY_CMD_SASL_LIST_MECHS.
The server's response is a string containing supported authentication mechanisms, which gets
stored into the (uninitialized) destination buffer without null termination.
The buffer then gets passed to sasl_client_start which treats it as a null-terminated string,
reading uninitialised bytes in the buffer.
As the buffer lives on the stack, an attacker that can put strings on the stack before the
connection gets made, might be able to tamper with the authentication [1].

[1] : https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594


In Ubuntu, the attached patch was applied to achieve the following:

  * Fix missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
    response handling (LP: #1573594)


Thanks for considering the patch.
#919696#10
Date:
2021-04-23 23:42:41 UTC
From:
To:
Here is the longer response:

https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594/comments/38

The original author of the bug did not read the internals of the code thoroughly enough to realize that the buffer would never be used if an error occurred, otherwise memcached_response will NULL terminate the string.

乌