CVE-2011-4862 PoC — FreeBSD ‘telnetd’ 缓冲区错误漏洞

介绍

# cve-2011-4862

I originally tried to use diff to make a patch.
I patched it the way I thought it would be, before looking
at the real patch.
encrypt.patch is this original patch that I made with teh
diff.
However, when we tried applying this patch to freeBSD, 
it would not accept it.

Instead, we had to fetch the real patch. I then changed the patch
to implement the fix the way I originally thought it should. This works
because it puts the whole path into the patch.

In the patch, we simply check the length compared to MAXLENGTH.
If it's bigger than that, set it to 0.
This way, it falls into the case of len = 0, which
errors out. This fixes it :-)

Here is an explanation of how to apply a patch in freeBSD.
https://www.freebsd.org/security/advisories/FreeBSD-SA-11:08.telnetd.asc
Simply use this patch instead of fetching the real one.
It will work, and you will no longer be able to exploit the buffer overflow.

文件快照

备注