[THRIFT-2006] TBinaryProtocol message header call name length is not validated and can be used to core the server

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Won't Fix
• Affects Version/s: 0.8
• Fix Version/s: 0.9.3
• Component/s: C++ - Library
• Labels: DenialOfService

Environment

SUSE linux

• Assignee: James E. King III
• Reporter: leeto
• Created: 08/Jun/13 08:18
• Updated: 30/Sep/15 20:18
• Resolved: 28/Sep/15 13:34

Description

When use "Nessus" tool scan the server, got below core file:

Program terminated with signal 11, Segmentation fault.
#0 0xf6a97d36 in memcpy () from /lib/libc.so.6
(gdb) bt
#0 0xf6a97d36 in memcpy () from /lib/libc.so.6
#1 0x3d5c9c24 in ?? ()
#2 0xf5c2096e in apache::thrift::transport::TVirtualTransport<apache::thrift::transport::TBufferedTransport, apache::thrift::transport::TBufferBase>::readAll_virt(unsigned char*, unsigned int) () from /var/opt/lib/libloggingsynchronizer.so
#3 0xf5c20d2c in apache::thrift::protocol::TBinaryProtocolT<apache::thrift::transport::TTransport>::readStringBody(std::string&, int) ()
from /var/opt/lib/libloggingsynchronizer.so
#4 0xf5c2139b in apache::thrift::protocol::TBinaryProtocolT<apache::thrift::transport::TTransport>::readMessageBegin(std::string&, apache::thrift::protocol::TMessageType&, int&) () from /var/opt/lib/libloggingsynchronizer.so
#5 0xf5c215e2 in apache::thrift::protocol::TVirtualProtocol<apache::thrift::protocol::TBinaryProtocolT<apache::thrift::transport::TTransport>, apache::thrift::protocol::TProtocolDefaults>::readMessageBegin_virt(std::string&, apache::thrift::protocol::TMessageType&, int&) ()
from /var/opt/lib/libloggingsynchronizer.so
#6 0xf5c182ad in Logging::LoggingConfigSynchronizerProcessor::process(boost::shared_ptr<apache::thrift::protocol::TProtocol>, boost::shared_ptr<apache::thrift::protocol::TProtocol>, void*) () from /var/opt/lib/libloggingsynchronizer.so
#7 0xed2b0d5b in apache::thrift::server::TSimpleServer::serve (this=0xf60eeba0) at src/server/TSimpleServer.cpp:103
#8 0xf5c1b378 in Logging::Synchronizer::serve() () from /var/opt/lib/libloggingsynchronizer.so