This is an archived web site made available for research purposes. The web site is no longer maintained.

Challenge Information - KPRCA_00062

Commonly known as: Multi_User_Calendar


Rounds Enabled

61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75

Details

Original Versions

Known Vulnerabilities

  • CWE-121 - Stack-based Buffer Overflow
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

None

Author Information

Kaprica Security

DARPA performer group

Kaprica Security (KPRCA)

Description

A multi-user calendar system that allows individual users to create personalized events and view those events.

Feature List

There are two interfaces the first which allows the creation, deletion and setting of users. Operations: 1. View users 2. Add user 3. Remove user 4. Set user 5. View Calendar 6. Change Date 7. Exit

After a user is created and "Set" the "View Calendar" mode is available. Operations: 1. View Day 2. View Month 3. View Agenda 4. Change Date 5. Change View Date 6. Add Calendar Event 7. Remove Calendar Event 8. Return to User Selection

The above operations allow for the creation and viewing of events on a users calendar. As well as the ability to look at upcoming events with "View Agenda". This will up to 8 events that occur in the next 3 months

Vulnerability

Vuln 1

In the find_user_from_list funtion there is an improper bounds check on the buffer that is copied into the temp_user.username variable. The vulnerability is only triggered when there are 100+ users in the system. This is due to a check that processes the user list within the find_user_from_list function rather than using the normal list interface find.

Generic class of vulnerability

Stack based buffer overflow

CWE classification

CWE-121

Challenges

The vulnerability requires a nontrivial amount of users to be added to the system before the bug is triggerable.

Difficulty

Discovering = Medium Proving = Easy Patching = Medium


POV Information

Round Source Destination Result POV Analysis Video
62 CSDS CodeJitsu Failed POV POV Watch
62 CSDS DeepRed Failed POV POV Watch
62 CSDS Disekt Failed POV POV Watch
62 CSDS ForAllSecure Failed POV POV Watch
62 CSDS Shellphish Failed POV POV Watch
62 CSDS TECHx Failed POV POV Watch
62 DeepRed CodeJitsu Failed POV POV Watch
62 DeepRed CSDS Failed POV POV Watch
62 DeepRed Disekt Failed POV POV Watch
62 DeepRed ForAllSecure Failed POV POV Watch
62 DeepRed Shellphish Failed POV POV Watch
62 DeepRed TECHx Failed POV POV Watch
63 CSDS CodeJitsu Failed POV through defenses POV Watch
63 CSDS DeepRed Failed POV POV Watch
63 CSDS Disekt Failed POV POV Watch
63 CSDS ForAllSecure Failed POV POV Watch
63 CSDS Shellphish Failed POV POV Watch
63 CSDS TECHx Failed POV POV Watch
63 DeepRed CodeJitsu Failed POV through defenses POV Watch
63 DeepRed CSDS Failed POV POV Watch
63 DeepRed Disekt Failed POV POV Watch
63 DeepRed ForAllSecure Failed POV POV Watch
63 DeepRed Shellphish Failed POV POV Watch
63 DeepRed TECHx Failed POV POV Watch
64 CodeJitsu Disekt Failed POV through defenses POV Watch
64 CSDS CodeJitsu Failed POV through defenses POV Watch
64 CSDS DeepRed Failed POV POV Watch
64 CSDS Disekt Failed POV through defenses POV Watch
64 CSDS ForAllSecure Failed POV POV Watch
64 CSDS Shellphish Failed POV POV Watch
64 CSDS TECHx Failed POV POV Watch
64 DeepRed CodeJitsu Failed POV through defenses POV Watch
64 DeepRed CSDS Failed POV POV Watch
64 DeepRed Disekt Failed POV through defenses POV Watch
64 DeepRed ForAllSecure Failed POV POV Watch
64 DeepRed Shellphish Failed POV POV Watch
64 DeepRed TECHx Failed POV POV Watch
65 CSDS CodeJitsu Failed POV through defenses POV Watch
65 CSDS DeepRed Failed POV POV Watch
65 CSDS Disekt Failed POV through defenses POV Watch
65 CSDS ForAllSecure Failed POV POV Watch
65 CSDS Shellphish Failed POV POV Watch
65 CSDS TECHx Failed POV POV Watch
65 DeepRed CodeJitsu Failed POV through defenses POV Watch
65 DeepRed CSDS Failed POV POV Watch
65 DeepRed Disekt Failed POV through defenses POV Watch
65 DeepRed ForAllSecure Failed POV POV Watch
65 DeepRed Shellphish Failed POV POV Watch
65 DeepRed TECHx Failed POV POV Watch
66 CodeJitsu Shellphish Failed POV through defenses POV Watch
66 CSDS CodeJitsu Failed POV through defenses POV Watch
66 CSDS DeepRed Failed POV POV Watch
66 CSDS Disekt Failed POV through defenses POV Watch
66 CSDS ForAllSecure Failed POV POV Watch
66 CSDS Shellphish Failed POV through defenses POV Watch
66 CSDS TECHx Failed POV POV Watch
66 DeepRed CodeJitsu Failed POV through defenses POV Watch
66 DeepRed CSDS Failed POV POV Watch
66 DeepRed Disekt Failed POV through defenses POV Watch
66 DeepRed ForAllSecure Failed POV POV Watch
66 DeepRed Shellphish Failed POV through defenses POV Watch
66 DeepRed TECHx Failed POV POV Watch
67 CodeJitsu Disekt Failed POV through defenses POV Watch
67 CSDS CodeJitsu Failed POV through defenses POV Watch
67 CSDS DeepRed Failed POV POV Watch
67 CSDS Disekt Failed POV through defenses POV Watch
67 CSDS ForAllSecure Failed POV POV Watch
67 CSDS Shellphish Failed POV through defenses POV Watch
67 CSDS TECHx Failed POV POV Watch
67 DeepRed CodeJitsu Failed POV through defenses POV Watch
67 DeepRed CSDS Failed POV POV Watch
67 DeepRed Disekt Failed POV through defenses POV Watch
67 DeepRed ForAllSecure Failed POV POV Watch
67 DeepRed Shellphish Failed POV through defenses POV Watch
67 DeepRed TECHx Failed POV POV Watch
67 Disekt CodeJitsu Failed POV through defenses POV Watch
67 Disekt CSDS Failed POV POV Watch
67 Disekt DeepRed Failed POV POV Watch
67 Disekt ForAllSecure Failed POV POV Watch
67 Disekt Shellphish Failed POV through defenses POV Watch
67 Disekt TECHx Failed POV POV Watch
68 CodeJitsu Disekt Failed POV through defenses POV Watch
68 CSDS CodeJitsu Failed POV through defenses POV Watch
68 CSDS DeepRed Failed POV POV Watch
68 CSDS Disekt Failed POV through defenses POV Watch
68 CSDS ForAllSecure Failed POV POV Watch
68 CSDS Shellphish Failed POV through defenses POV Watch
68 CSDS TECHx Failed POV POV Watch
68 DeepRed CodeJitsu Failed POV through defenses POV Watch
68 DeepRed CSDS Failed POV POV Watch
68 DeepRed Disekt Failed POV through defenses POV Watch
68 DeepRed ForAllSecure Failed POV POV Watch
68 DeepRed Shellphish Failed POV through defenses POV Watch
68 DeepRed TECHx Failed POV POV Watch
68 Disekt CodeJitsu Failed POV through defenses POV Watch
68 Disekt CSDS Failed POV POV Watch
68 Disekt DeepRed Failed POV POV Watch
68 Disekt ForAllSecure Failed POV POV Watch
68 Disekt Shellphish Failed POV through defenses POV Watch
68 Disekt TECHx Failed POV POV Watch
69 CodeJitsu Shellphish Failed POV POV Watch
69 CSDS CodeJitsu Failed POV through defenses POV Watch
69 CSDS DeepRed Failed POV POV Watch
69 CSDS Disekt Failed POV through defenses POV Watch
69 CSDS ForAllSecure Failed POV POV Watch
69 CSDS Shellphish Failed POV POV Watch
69 CSDS TECHx Failed POV POV Watch
69 DeepRed CodeJitsu Failed POV through defenses POV Watch
69 DeepRed CSDS Failed POV POV Watch
69 DeepRed Disekt Failed POV through defenses POV Watch
69 DeepRed ForAllSecure Failed POV POV Watch
69 DeepRed Shellphish Failed POV POV Watch
69 DeepRed TECHx Failed POV POV Watch
69 Disekt CodeJitsu Failed POV through defenses POV Watch
69 Disekt CSDS Failed POV POV Watch
69 Disekt DeepRed Failed POV POV Watch
69 Disekt ForAllSecure Failed POV POV Watch
69 Disekt Shellphish Failed POV POV Watch
69 Disekt TECHx Failed POV POV Watch
70 CSDS CodeJitsu Failed POV through defenses POV Watch
70 CSDS DeepRed Failed POV POV Watch
70 CSDS Disekt Failed POV through defenses POV Watch
70 CSDS ForAllSecure Failed POV POV Watch
70 CSDS Shellphish Failed POV POV Watch
70 CSDS TECHx Failed POV POV Watch
70 DeepRed CodeJitsu Failed POV through defenses POV Watch
70 DeepRed CSDS Failed POV POV Watch
70 DeepRed Disekt Failed POV through defenses POV Watch
70 DeepRed ForAllSecure Failed POV POV Watch
70 DeepRed Shellphish Failed POV POV Watch
70 DeepRed TECHx Failed POV POV Watch
70 Disekt CodeJitsu Failed POV through defenses POV Watch
70 Disekt CSDS Failed POV POV Watch
70 Disekt DeepRed Failed POV POV Watch
70 Disekt ForAllSecure Failed POV POV Watch
70 Disekt Shellphish Failed POV POV Watch
70 Disekt TECHx Failed POV POV Watch
71 CSDS CodeJitsu Failed POV through defenses POV Watch
71 CSDS DeepRed Failed POV POV Watch
71 CSDS Disekt Failed POV through defenses POV Watch
71 CSDS ForAllSecure Failed POV POV Watch
71 CSDS Shellphish Failed POV POV Watch
71 CSDS TECHx Failed POV POV Watch
71 DeepRed CodeJitsu Failed POV through defenses POV Watch
71 DeepRed CSDS Failed POV POV Watch
71 DeepRed Disekt Failed POV through defenses POV Watch
71 DeepRed ForAllSecure Failed POV POV Watch
71 DeepRed Shellphish Failed POV POV Watch
71 DeepRed TECHx Failed POV POV Watch
71 Disekt CodeJitsu Failed POV through defenses POV Watch
71 Disekt CSDS Failed POV POV Watch
71 Disekt DeepRed Failed POV POV Watch
71 Disekt ForAllSecure Failed POV POV Watch
71 Disekt Shellphish Failed POV POV Watch
71 Disekt TECHx Failed POV POV Watch
72 CSDS CodeJitsu Failed POV through defenses POV Watch
72 CSDS DeepRed Failed POV POV Watch
72 CSDS Disekt Failed POV through defenses POV Watch
72 CSDS ForAllSecure Failed POV POV Watch
72 CSDS Shellphish Failed POV POV Watch
72 CSDS TECHx Failed POV POV Watch
72 DeepRed CodeJitsu Failed POV through defenses POV Watch
72 DeepRed CSDS Failed POV POV Watch
72 DeepRed Disekt Failed POV through defenses POV Watch
72 DeepRed ForAllSecure Failed POV POV Watch
72 DeepRed Shellphish Failed POV POV Watch
72 DeepRed TECHx Failed POV POV Watch
72 Disekt CodeJitsu Failed POV through defenses POV Watch
72 Disekt CSDS Failed POV POV Watch
72 Disekt DeepRed Failed POV POV Watch
72 Disekt ForAllSecure Failed POV POV Watch
72 Disekt Shellphish Failed POV POV Watch
72 Disekt TECHx Failed POV POV Watch
73 CSDS CodeJitsu Failed POV through defenses POV Watch
73 CSDS DeepRed Failed POV POV Watch
73 CSDS Disekt Failed POV through defenses POV Watch
73 CSDS ForAllSecure Failed POV POV Watch
73 CSDS Shellphish Failed POV POV Watch
73 CSDS TECHx Failed POV POV Watch
73 DeepRed CodeJitsu Failed POV through defenses POV Watch
73 DeepRed CSDS Failed POV POV Watch
73 DeepRed Disekt Failed POV through defenses POV Watch
73 DeepRed ForAllSecure Failed POV POV Watch
73 DeepRed Shellphish Failed POV POV Watch
73 DeepRed TECHx Failed POV POV Watch
73 Disekt CodeJitsu Failed POV through defenses POV Watch
73 Disekt CSDS Failed POV POV Watch
73 Disekt DeepRed Failed POV POV Watch
73 Disekt ForAllSecure Failed POV POV Watch
73 Disekt Shellphish Failed POV POV Watch
73 Disekt TECHx Failed POV POV Watch
74 CSDS CodeJitsu Failed POV through defenses POV Watch
74 CSDS DeepRed Failed POV POV Watch
74 CSDS Disekt Failed POV through defenses POV Watch
74 CSDS ForAllSecure Failed POV POV Watch
74 CSDS Shellphish Failed POV POV Watch
74 CSDS TECHx Failed POV POV Watch
74 DeepRed CodeJitsu Failed POV through defenses POV Watch
74 DeepRed CSDS Failed POV POV Watch
74 DeepRed Disekt Failed POV through defenses POV Watch
74 DeepRed ForAllSecure Failed POV POV Watch
74 DeepRed Shellphish Failed POV POV Watch
74 DeepRed TECHx Failed POV POV Watch
74 Disekt CodeJitsu Failed POV through defenses POV Watch
74 Disekt CSDS Failed POV POV Watch
74 Disekt DeepRed Failed POV POV Watch
74 Disekt ForAllSecure Failed POV POV Watch
74 Disekt Shellphish Failed POV POV Watch
74 Disekt TECHx Failed POV POV Watch
75 CSDS CodeJitsu Failed POV through defenses POV Watch
75 CSDS DeepRed Failed POV POV Watch
75 CSDS Disekt Failed POV through defenses POV Watch
75 CSDS ForAllSecure Failed POV POV Watch
75 CSDS Shellphish Failed POV POV Watch
75 CSDS TECHx Failed POV POV Watch
75 DeepRed CodeJitsu Failed POV through defenses POV Watch
75 DeepRed CSDS Failed POV POV Watch
75 DeepRed Disekt Failed POV through defenses POV Watch
75 DeepRed ForAllSecure Failed POV POV Watch
75 DeepRed Shellphish Failed POV POV Watch
75 DeepRed TECHx Failed POV POV Watch
75 Disekt CodeJitsu Failed POV through defenses POV Watch
75 Disekt CSDS Failed POV POV Watch
75 Disekt DeepRed Failed POV POV Watch
75 Disekt ForAllSecure Failed POV POV Watch
75 Disekt Shellphish Failed POV POV Watch
75 Disekt TECHx Failed POV POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email