Possible remote vulnerability problem in TIS FWTK x-gw?

[Pekka Savola <pekkas () NETCORE FI>]

Hello all,

I got around to checking out TIS FWTK for format string problems.  It's a
free-for-non-commercials firewall proxy package.  The sources etc. can be
obtained from http://www.tis.com/research/software/fwtk_readme.html.

Tried to contact security () tis com, mail bounced.  Oh well.

This is usually run in non-chrooted, root environment.

There are like 10 occasions where a function 'pmsg' is used.  pmsg is
defined as follows (a part snipped):

---
   if( perrno ) {
       sprintf( buf, "%.7500s: %.500s\n", msg, strerror(errno) );
   } else {
        strncpy(buf, msg, sizeof(buf));  <-- no checking if perrno=0; this
                                                is the case below
        buf[sizeof(buf)-1] = '\0';
   }

   if( uselog ) syslog( LLEV, buf );   <-- not good!
   else {
       fprintf( stderr, buf );  <-- not good either
       fflush(stderr);
   }
---

This could be pretty non-optimal if buf isn't checked very
carefully.  Usually there is done checking done though.

However, in x-gw.c you can cause a segmentation fault in execing x-gw
program as follows:

---
tn-gw-> x-gw somehost:101%s
---
This has to be > "100" and not contain '/''s (for example) to get around
the checks.

The crash appears at pmsg(buf,0), see [*] below.

---
        bzero(buf,256);
        if( !(dpy=getarg("disp",switches)) &&
            !(dpy=getarg("from",switches)) &&
            !(dpy=getenv("DISPLAY")) ) {
                sprintf(buf,"%s:0.0",host );
        } else {
                /* dpy=hostname/xxx.xx.xxx.xx:pp */
                sprintf(buf,"%s%s",(p=strchr(dpy,'/'))?&p[1]:dpy,
                                   (!strchr(dpy,':'))?":0.0":"");
        }
        dpy=setarg("disp",buf,switches);
        len=strcspn(buf,":");
        buf[len]='\0';

                /* the display hostname */
        if( (pid=atoi(dpy+len+1)) < 0 || pid>(toport-BASE_PORT) ) {
                sprintf(buf,"Invalid display=%s. Must be 0-100\n",dpy+len+1);
[*]             pmsg(buf,0);
                goto out;
        }
        if( !XOpenDisplay(dpy) ) { /* check the display */
                fprintf( stderr,"Unable to open display=%s\r\n",dpy );
                goto out;
        }
---

Anyone know if these could be developed into a real vulnerability/exploit?
I'm not looking for a full-blown exploit, really -- even though it
wouldn't hurt :-).  I'd like some kind of tentative analysis how
possible/probable making an exploit of this one would be.

Please Cc: as I'm not on the list.
--
Pekka Savola                 "Tell me of difficulties surmounted,
Pekka.Savola () netcore fi      not those you stumble over and fall"