Title: [xfocus-SD-051202]openMotif-libUil-Multiple_vulnerability

Affected version : openmotif 2.2.3(not got 2.2.4,so not test in
openmotif 2.2.4)
Product: http://www.motifzone.net/
bugtraq id: 15678

xfocus (http://www.xfocus.org) have discovered multiple vulnerability in
openmotif libUil library. details following:

1: libUil.so diag_issue_diagnostic buffer overflow

Clients/uil/UilDiags.c
diag_issue_diagnostic()
202 void diag_issue_diagnostic
203 ( int d_message_number, src_source_record_type
*az_src_rec,
204 int l_start_column, ...)
205
206 {
207 va_list ap; /* ptr to variable length parameter */
208 int severity; /* severity of message */
209 int message_number; /* message number */
210 char msg_buffer[132]; /* buffer to onstruct
message */
211 char ptr_buffer[buf_size]; /* buffer to construct pointer */
212 char loc_buffer[132]; /* buffer to construct
location */
213 char src_buffer[buf_size]; /* buffer to hold source line */
......
293 va_start(ap, l_start_column);
294
295 #ifndef NO_MESSAGE_CATALOG
296[1.1] vsprintf( msg_buffer,
297 catgets(uil_catd, UIL_SET1, msg_cat_table[
message_number ],
298 diag_rz_msg_table[ message_number].ac_text),
299 ap );
300 #else
301[1.2] vsprintf( msg_buffer,
302 diag_rz_msg_table[ message_number ].ac_text,
303 ap );

304 #endif
305 va_end(ap);

[1.1][1.2] call vsprintf will cause buffer overflow if ap is user-support
data,so if one local or remote application which used this library may
cause execute arbitrary code .

2: libUil.so open_source_file buffer voerflow

Clients/uil/UilSrcSrc.c

620 status
621 open_source_file( XmConst char *c_file_name,
622 uil_fcb_type *az_fcb,
623 src_source_buffer_type *az_source_buffer )
624 {
625
626 static unsigned short main_dir_len = 0;
627 boolean main_file;
628 int i; /* loop index through
include files */
629 char buffer[256];
630
631
632 /* place the file name in the expanded_name buffer */
633
634[2.1] strcpy(buffer, c_file_name);
635
636 /* Determine if this is the main file or an include file. */
637
638 main_file = (main_fcb == NULL);
639
[2.1] like above