This is an archived web site made available for research purposes. The web site is no longer maintained.

Challenge Information - CROMU_00098

Commonly known as: REMATCH_2--Mail_Server--Crackaddr


Rounds Enabled

33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47

Details

Original Versions

Known Vulnerabilities

  • CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

None

Author Information

debbie@cromulence.com

DARPA performer group

Cromulence LLC (CROMU)

Description

This binary mimics the function in sendmail that was vulnerable to CVE-2002-1337 commonly known as the crackaddr bug. Sendmail is an email server originally published in 1983. The CVE-2002-1337 was a buffer overflow in the crackaddr function for email address parsing. In 2011, 8 years after the bug was published, security researcher Thomas Dullien (AKA Halvar Flake) showcased the bug as something static analysis tools were unable to detect and created a simplified implementation to demonstrate that point. Since then, multiple teams have used the crackaddr bug as a litmus test for the real world viability of analysis tools. To date some tools have been able to detect the vulnerability in the simplified version but not the original. This implementation closely mimics the original bug in sendmail.

Feature List

The crackaddr function in sendmail was created to parse addresses with a complex combination of embedded parenthesis, angle brackets, quotes, and grouping syntax. The function recreated here adds in some additional complexity from the original function and changes all the special characters to other ascii values.

Vulnerability

The vulnerability is an error in how the while loop keeps track of matching "brackets". A pointer is used to indicate the end of the expected output stream. That pointer is manipulated to make sure there is enough room to close out any opened brackets with matching close brackets. The error occurs when the pointer is incremented on a close bracket, but not decremented on the previous open bracket. This allows the pointer to end up pointing past the end of the actual output buffer, alowing the input stream to overwrite a portion of the stack.

Generic class of vulnerability

Buffer Overflow

CWE classification

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Challenges

The crackaddr function poses a complex challenge to the CRS. The unbounded nature of the input prevents imposing a simple size restriction because that would lead to failing valid polls. The CRS must then interpret exactly which overly long inputs would result in an overflow of the output. The crackaddr function modifies the output bounds based on the sequence of input characters in a while loop which quickly leads to an unmanageable state equation for the CRS.


POV Information

Round Source Destination Result POV Analysis Video
34 CSDS CodeJitsu Failed POV POV Watch
34 CSDS DeepRed Failed POV POV Watch
34 CSDS Disekt Failed POV POV Watch
34 CSDS ForAllSecure Failed POV POV Watch
34 CSDS Shellphish Failed POV POV Watch
34 CSDS TECHx Failed POV POV Watch
34 DeepRed CodeJitsu Failed POV POV Watch
34 DeepRed CSDS Failed POV POV Watch
34 DeepRed Disekt Failed POV POV Watch
34 DeepRed ForAllSecure Failed POV POV Watch
34 DeepRed Shellphish Failed POV POV Watch
34 DeepRed TECHx Failed POV POV Watch
34 ForAllSecure CodeJitsu Failed POV POV Watch
34 ForAllSecure CSDS Failed POV POV Watch
34 ForAllSecure DeepRed Failed POV POV Watch
34 ForAllSecure Disekt Failed POV POV Watch
34 ForAllSecure Shellphish Failed POV POV Watch
34 ForAllSecure TECHx Failed POV POV Watch
35 CSDS CodeJitsu Failed POV POV Watch
35 CSDS DeepRed Failed POV POV Watch
35 CSDS Disekt Failed POV POV Watch
35 CSDS ForAllSecure Failed POV POV Watch
35 CSDS Shellphish Failed POV POV Watch
35 CSDS TECHx Failed POV POV Watch
35 DeepRed CodeJitsu Failed POV POV Watch
35 DeepRed CSDS Failed POV POV Watch
35 DeepRed Disekt Failed POV POV Watch
35 DeepRed ForAllSecure Failed POV POV Watch
35 DeepRed Shellphish Failed POV POV Watch
35 DeepRed TECHx Failed POV POV Watch
35 ForAllSecure CodeJitsu Failed POV POV Watch
35 ForAllSecure CSDS Failed POV POV Watch
35 ForAllSecure DeepRed Failed POV POV Watch
35 ForAllSecure Disekt Failed POV POV Watch
35 ForAllSecure Shellphish Failed POV POV Watch
35 ForAllSecure TECHx Failed POV POV Watch
36 CodeJitsu Shellphish Failed POV through defenses POV Watch
36 CSDS CodeJitsu Failed POV POV Watch
36 CSDS DeepRed Failed POV POV Watch
36 CSDS Disekt Failed POV POV Watch
36 CSDS ForAllSecure Failed POV POV Watch
36 CSDS Shellphish Failed POV through defenses POV Watch
36 CSDS TECHx Failed POV POV Watch
36 DeepRed CodeJitsu Failed POV POV Watch
36 DeepRed CSDS Failed POV POV Watch
36 DeepRed Disekt Failed POV POV Watch
36 DeepRed ForAllSecure Failed POV POV Watch
36 DeepRed Shellphish Failed POV through defenses POV Watch
36 DeepRed TECHx Failed POV POV Watch
36 ForAllSecure CodeJitsu Failed POV POV Watch
36 ForAllSecure CSDS Failed POV POV Watch
36 ForAllSecure DeepRed Failed POV POV Watch
36 ForAllSecure Disekt Failed POV POV Watch
36 ForAllSecure Shellphish Failed POV through defenses POV Watch
36 ForAllSecure TECHx Failed POV POV Watch
37 CSDS CodeJitsu Failed POV POV Watch
37 CSDS DeepRed Failed POV POV Watch
37 CSDS Disekt Failed POV POV Watch
37 CSDS ForAllSecure Failed POV POV Watch
37 CSDS Shellphish Failed POV through defenses POV Watch
37 CSDS TECHx Failed POV POV Watch
37 DeepRed CodeJitsu Failed POV POV Watch
37 DeepRed CSDS Failed POV POV Watch
37 DeepRed Disekt Failed POV POV Watch
37 DeepRed ForAllSecure Failed POV POV Watch
37 DeepRed Shellphish Failed POV through defenses POV Watch
37 DeepRed TECHx Failed POV POV Watch
37 ForAllSecure CodeJitsu Failed POV POV Watch
37 ForAllSecure CSDS Failed POV POV Watch
37 ForAllSecure DeepRed Failed POV POV Watch
37 ForAllSecure Disekt Failed POV POV Watch
37 ForAllSecure Shellphish Failed POV through defenses POV Watch
37 ForAllSecure TECHx Failed POV POV Watch
38 CSDS CodeJitsu Failed POV POV Watch
38 CSDS DeepRed Failed POV POV Watch
38 CSDS Disekt Failed POV POV Watch
38 CSDS ForAllSecure Failed POV POV Watch
38 CSDS Shellphish Failed POV through defenses POV Watch
38 CSDS TECHx Failed POV POV Watch
38 DeepRed CodeJitsu Failed POV POV Watch
38 DeepRed CSDS Failed POV POV Watch
38 DeepRed Disekt Failed POV POV Watch
38 DeepRed ForAllSecure Failed POV POV Watch
38 DeepRed Shellphish Failed POV through defenses POV Watch
38 DeepRed TECHx Failed POV POV Watch
38 ForAllSecure CodeJitsu Failed POV POV Watch
38 ForAllSecure CSDS Failed POV POV Watch
38 ForAllSecure DeepRed Failed POV POV Watch
38 ForAllSecure Disekt Failed POV POV Watch
38 ForAllSecure Shellphish Failed POV through defenses POV Watch
38 ForAllSecure TECHx Failed POV POV Watch
39 CSDS CodeJitsu Failed POV POV Watch
39 CSDS DeepRed Failed POV POV Watch
39 CSDS Disekt Failed POV POV Watch
39 CSDS ForAllSecure Failed POV POV Watch
39 CSDS Shellphish Failed POV through defenses POV Watch
39 CSDS TECHx Failed POV POV Watch
39 DeepRed CodeJitsu Failed POV POV Watch
39 DeepRed CSDS Failed POV POV Watch
39 DeepRed Disekt Failed POV POV Watch
39 DeepRed ForAllSecure Failed POV POV Watch
39 DeepRed Shellphish Failed POV through defenses POV Watch
39 DeepRed TECHx Failed POV POV Watch
39 ForAllSecure CodeJitsu Failed POV POV Watch
39 ForAllSecure CSDS Failed POV POV Watch
39 ForAllSecure DeepRed Failed POV POV Watch
39 ForAllSecure Disekt Failed POV POV Watch
39 ForAllSecure Shellphish Failed POV through defenses POV Watch
39 ForAllSecure TECHx Failed POV POV Watch
40 CSDS CodeJitsu Failed POV POV Watch
40 CSDS DeepRed Failed POV POV Watch
40 CSDS Disekt Failed POV POV Watch
40 CSDS ForAllSecure Failed POV POV Watch
40 CSDS Shellphish Failed POV through defenses POV Watch
40 CSDS TECHx Failed POV POV Watch
40 DeepRed CodeJitsu Failed POV POV Watch
40 DeepRed CSDS Failed POV POV Watch
40 DeepRed Disekt Failed POV POV Watch
40 DeepRed ForAllSecure Failed POV POV Watch
40 DeepRed Shellphish Failed POV through defenses POV Watch
40 DeepRed TECHx Failed POV POV Watch
40 ForAllSecure CodeJitsu Failed POV POV Watch
40 ForAllSecure CSDS Failed POV POV Watch
40 ForAllSecure DeepRed Failed POV POV Watch
40 ForAllSecure Disekt Failed POV POV Watch
40 ForAllSecure Shellphish Failed POV through defenses POV Watch
40 ForAllSecure TECHx Failed POV POV Watch
41 CSDS CodeJitsu Failed POV POV Watch
41 CSDS DeepRed Failed POV POV Watch
41 CSDS Disekt Failed POV POV Watch
41 CSDS ForAllSecure Failed POV POV Watch
41 CSDS Shellphish Failed POV through defenses POV Watch
41 CSDS TECHx Failed POV POV Watch
41 DeepRed CodeJitsu Failed POV POV Watch
41 DeepRed CSDS Failed POV POV Watch
41 DeepRed Disekt Failed POV POV Watch
41 DeepRed ForAllSecure Failed POV POV Watch
41 DeepRed Shellphish Failed POV through defenses POV Watch
41 DeepRed TECHx Failed POV POV Watch
41 ForAllSecure CodeJitsu Failed POV POV Watch
41 ForAllSecure CSDS Failed POV POV Watch
41 ForAllSecure DeepRed Failed POV POV Watch
41 ForAllSecure Disekt Failed POV POV Watch
41 ForAllSecure Shellphish Failed POV through defenses POV Watch
41 ForAllSecure TECHx Failed POV POV Watch
42 CodeJitsu Shellphish Failed POV POV Watch
42 CSDS CodeJitsu Failed POV POV Watch
42 CSDS DeepRed Failed POV POV Watch
42 CSDS Disekt Failed POV POV Watch
42 CSDS ForAllSecure Failed POV POV Watch
42 CSDS Shellphish Failed POV POV Watch
42 CSDS TECHx Failed POV POV Watch
42 DeepRed CodeJitsu Failed POV POV Watch
42 DeepRed CSDS Failed POV POV Watch
42 DeepRed Disekt Failed POV POV Watch
42 DeepRed ForAllSecure Failed POV POV Watch
42 DeepRed Shellphish Failed POV POV Watch
42 DeepRed TECHx Failed POV POV Watch
42 ForAllSecure CodeJitsu Failed POV POV Watch
42 ForAllSecure CSDS Failed POV POV Watch
42 ForAllSecure DeepRed Failed POV POV Watch
42 ForAllSecure Disekt Failed POV POV Watch
42 ForAllSecure Shellphish Failed POV POV Watch
42 ForAllSecure TECHx Failed POV POV Watch
43 CSDS CodeJitsu Failed POV POV Watch
43 CSDS DeepRed Failed POV POV Watch
43 CSDS Disekt Failed POV POV Watch
43 CSDS ForAllSecure Failed POV POV Watch
43 CSDS Shellphish Failed POV POV Watch
43 CSDS TECHx Failed POV POV Watch
43 DeepRed CodeJitsu Failed POV POV Watch
43 DeepRed CSDS Failed POV POV Watch
43 DeepRed Disekt Failed POV POV Watch
43 DeepRed ForAllSecure Failed POV POV Watch
43 DeepRed Shellphish Failed POV POV Watch
43 DeepRed TECHx Failed POV POV Watch
43 ForAllSecure CodeJitsu Failed POV POV Watch
43 ForAllSecure CSDS Failed POV POV Watch
43 ForAllSecure DeepRed Failed POV POV Watch
43 ForAllSecure Disekt Failed POV POV Watch
43 ForAllSecure Shellphish Failed POV POV Watch
43 ForAllSecure TECHx Failed POV POV Watch
44 CSDS CodeJitsu Failed POV POV Watch
44 CSDS DeepRed Failed POV POV Watch
44 CSDS Disekt Failed POV POV Watch
44 CSDS ForAllSecure Failed POV POV Watch
44 CSDS Shellphish Failed POV POV Watch
44 CSDS TECHx Failed POV POV Watch
44 DeepRed CodeJitsu Failed POV POV Watch
44 DeepRed CSDS Failed POV POV Watch
44 DeepRed Disekt Failed POV POV Watch
44 DeepRed ForAllSecure Failed POV POV Watch
44 DeepRed Shellphish Failed POV POV Watch
44 DeepRed TECHx Failed POV POV Watch
44 ForAllSecure CodeJitsu Failed POV POV Watch
44 ForAllSecure CSDS Failed POV POV Watch
44 ForAllSecure DeepRed Failed POV POV Watch
44 ForAllSecure Disekt Failed POV POV Watch
44 ForAllSecure Shellphish Failed POV POV Watch
44 ForAllSecure TECHx Failed POV POV Watch
45 CSDS CodeJitsu Failed POV POV Watch
45 CSDS DeepRed Failed POV POV Watch
45 CSDS Disekt Failed POV POV Watch
45 CSDS ForAllSecure Failed POV POV Watch
45 CSDS Shellphish Failed POV POV Watch
45 CSDS TECHx Failed POV POV Watch
45 DeepRed CodeJitsu Failed POV POV Watch
45 DeepRed CSDS Failed POV POV Watch
45 DeepRed Disekt Failed POV POV Watch
45 DeepRed ForAllSecure Failed POV POV Watch
45 DeepRed Shellphish Failed POV POV Watch
45 DeepRed TECHx Failed POV POV Watch
45 ForAllSecure CodeJitsu Failed POV POV Watch
45 ForAllSecure CSDS Failed POV POV Watch
45 ForAllSecure DeepRed Failed POV POV Watch
45 ForAllSecure Disekt Failed POV POV Watch
45 ForAllSecure Shellphish Failed POV POV Watch
45 ForAllSecure TECHx Failed POV POV Watch
46 CSDS CodeJitsu Failed POV POV Watch
46 CSDS DeepRed Failed POV POV Watch
46 CSDS Disekt Failed POV POV Watch
46 CSDS ForAllSecure Failed POV POV Watch
46 CSDS Shellphish Failed POV POV Watch
46 CSDS TECHx Failed POV POV Watch
46 DeepRed CodeJitsu Failed POV POV Watch
46 DeepRed CSDS Failed POV POV Watch
46 DeepRed Disekt Failed POV POV Watch
46 DeepRed ForAllSecure Failed POV POV Watch
46 DeepRed Shellphish Failed POV POV Watch
46 DeepRed TECHx Failed POV POV Watch
46 ForAllSecure CodeJitsu Failed POV POV Watch
46 ForAllSecure CSDS Failed POV POV Watch
46 ForAllSecure DeepRed Failed POV POV Watch
46 ForAllSecure Disekt Failed POV POV Watch
46 ForAllSecure Shellphish Failed POV POV Watch
46 ForAllSecure TECHx Failed POV POV Watch
46 Shellphish DeepRed Successful POV POV Analysis Watch
46 Shellphish Disekt Successful POV POV Analysis Watch
46 Shellphish ForAllSecure Successful POV POV Analysis Watch
46 Shellphish TECHx Successful POV POV Analysis Watch
47 CodeJitsu Disekt Failed POV through defenses POV Watch
47 CSDS CodeJitsu Failed POV POV Watch
47 CSDS DeepRed Failed POV POV Watch
47 CSDS Disekt Failed POV through defenses POV Watch
47 CSDS ForAllSecure Failed POV POV Watch
47 CSDS Shellphish Failed POV POV Watch
47 CSDS TECHx Failed POV POV Watch
47 DeepRed CodeJitsu Failed POV POV Watch
47 DeepRed CSDS Failed POV POV Watch
47 DeepRed Disekt Failed POV through defenses POV Watch
47 DeepRed ForAllSecure Failed POV POV Watch
47 DeepRed Shellphish Failed POV POV Watch
47 DeepRed TECHx Failed POV POV Watch
47 ForAllSecure CodeJitsu Failed POV POV Watch
47 ForAllSecure CSDS Failed POV POV Watch
47 ForAllSecure DeepRed Failed POV POV Watch
47 ForAllSecure Disekt Failed POV through defenses POV Watch
47 ForAllSecure Shellphish Failed POV POV Watch
47 ForAllSecure TECHx Failed POV POV Watch
47 Shellphish CodeJitsu Successful POV POV Analysis Watch
47 Shellphish CSDS Successful POV POV Analysis Watch
47 Shellphish DeepRed Successful POV POV Analysis Watch
47 Shellphish Disekt Failed POV through defenses POV Watch
47 Shellphish ForAllSecure Successful POV POV Analysis Watch
47 Shellphish TECHx Successful POV POV Analysis Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email