Rounds Enabled

61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75

Details

• POV Information

Original Versions

• Original Build: CB1
• Author-supplied patches: CB1
• Author-supplied POVs: POV1
• Browse Source

Known Vulnerabilities

• CWE-121 - Stack-based Buffer Overflow
CWEs are listed as indicated by the challenge author.

Deployed patches

• Round 63 : CodeJitsu - CB1 (disassembly)
• Round 64 : Disekt - CB1 (disassembly)
• Round 66 : CodeJitsu - CB1 (disassembly)
• Round 66 : Shellphish - CB1 (disassembly)
• Round 67 : CodeJitsu - CB1 (disassembly)
• Round 67 : Disekt - CB1 (disassembly)
• Round 68 : CodeJitsu - CB1 (disassembly)
• Round 68 : Disekt - CB1 (disassembly)
• Round 69 : Shellphish - CB1 (disassembly)
• Round 71 : CodeJitsu - CB1 (disassembly)
• Round 73 : CodeJitsu - CB1 (disassembly)
• Round 74 : CodeJitsu - CB1 (disassembly)

Deployed IDS rules

None

Author Information

Kaprica Security

DARPA performer group

Kaprica Security (KPRCA)

Description

A multi-user calendar system that allows individual users to create personalized events and view those events.

Feature List

There are two interfaces the first which allows the creation, deletion and setting of users. Operations: 1. View users 2. Add user 3. Remove user 4. Set user 5. View Calendar 6. Change Date 7. Exit

After a user is created and "Set" the "View Calendar" mode is available. Operations: 1. View Day 2. View Month 3. View Agenda 4. Change Date 5. Change View Date 6. Add Calendar Event 7. Remove Calendar Event 8. Return to User Selection

The above operations allow for the creation and viewing of events on a users calendar. As well as the ability to look at upcoming events with "View Agenda". This will up to 8 events that occur in the next 3 months

Vulnerability

Vuln 1

In the find_user_from_list funtion there is an improper bounds check on the buffer that is copied into the temp_user.username variable. The vulnerability is only triggered when there are 100+ users in the system. This is due to a check that processes the user list within the find_user_from_list function rather than using the normal list interface find.

Generic class of vulnerability

Stack based buffer overflow

CWE classification

CWE-121

Challenges

The vulnerability requires a nontrivial amount of users to be added to the system before the bug is triggerable.

Difficulty

Discovering = Medium Proving = Easy Patching = Medium

Round	Source	Destination	Result	POV	Analysis	Video
62	CSDS	CodeJitsu	Failed POV	POV		Watch
62	CSDS	DeepRed	Failed POV	POV		Watch
62	CSDS	Disekt	Failed POV	POV		Watch
62	CSDS	ForAllSecure	Failed POV	POV		Watch
62	CSDS	Shellphish	Failed POV	POV		Watch
62	CSDS	TECHx	Failed POV	POV		Watch
62	DeepRed	CodeJitsu	Failed POV	POV		Watch
62	DeepRed	CSDS	Failed POV	POV		Watch
62	DeepRed	Disekt	Failed POV	POV		Watch
62	DeepRed	ForAllSecure	Failed POV	POV		Watch
62	DeepRed	Shellphish	Failed POV	POV		Watch
62	DeepRed	TECHx	Failed POV	POV		Watch
63	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
63	CSDS	DeepRed	Failed POV	POV		Watch
63	CSDS	Disekt	Failed POV	POV		Watch
63	CSDS	ForAllSecure	Failed POV	POV		Watch
63	CSDS	Shellphish	Failed POV	POV		Watch
63	CSDS	TECHx	Failed POV	POV		Watch
63	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
63	DeepRed	CSDS	Failed POV	POV		Watch
63	DeepRed	Disekt	Failed POV	POV		Watch
63	DeepRed	ForAllSecure	Failed POV	POV		Watch
63	DeepRed	Shellphish	Failed POV	POV		Watch
63	DeepRed	TECHx	Failed POV	POV		Watch
64	CodeJitsu	Disekt	Failed POV through defenses	POV		Watch
64	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
64	CSDS	DeepRed	Failed POV	POV		Watch
64	CSDS	Disekt	Failed POV through defenses	POV		Watch
64	CSDS	ForAllSecure	Failed POV	POV		Watch
64	CSDS	Shellphish	Failed POV	POV		Watch
64	CSDS	TECHx	Failed POV	POV		Watch
64	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
64	DeepRed	CSDS	Failed POV	POV		Watch
64	DeepRed	Disekt	Failed POV through defenses	POV		Watch
64	DeepRed	ForAllSecure	Failed POV	POV		Watch
64	DeepRed	Shellphish	Failed POV	POV		Watch
64	DeepRed	TECHx	Failed POV	POV		Watch
65	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
65	CSDS	DeepRed	Failed POV	POV		Watch
65	CSDS	Disekt	Failed POV through defenses	POV		Watch
65	CSDS	ForAllSecure	Failed POV	POV		Watch
65	CSDS	Shellphish	Failed POV	POV		Watch
65	CSDS	TECHx	Failed POV	POV		Watch
65	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
65	DeepRed	CSDS	Failed POV	POV		Watch
65	DeepRed	Disekt	Failed POV through defenses	POV		Watch
65	DeepRed	ForAllSecure	Failed POV	POV		Watch
65	DeepRed	Shellphish	Failed POV	POV		Watch
65	DeepRed	TECHx	Failed POV	POV		Watch
66	CodeJitsu	Shellphish	Failed POV through defenses	POV		Watch
66	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
66	CSDS	DeepRed	Failed POV	POV		Watch
66	CSDS	Disekt	Failed POV through defenses	POV		Watch
66	CSDS	ForAllSecure	Failed POV	POV		Watch
66	CSDS	Shellphish	Failed POV through defenses	POV		Watch
66	CSDS	TECHx	Failed POV	POV		Watch
66	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
66	DeepRed	CSDS	Failed POV	POV		Watch
66	DeepRed	Disekt	Failed POV through defenses	POV		Watch
66	DeepRed	ForAllSecure	Failed POV	POV		Watch
66	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
66	DeepRed	TECHx	Failed POV	POV		Watch
67	CodeJitsu	Disekt	Failed POV through defenses	POV		Watch
67	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
67	CSDS	DeepRed	Failed POV	POV		Watch
67	CSDS	Disekt	Failed POV through defenses	POV		Watch
67	CSDS	ForAllSecure	Failed POV	POV		Watch
67	CSDS	Shellphish	Failed POV through defenses	POV		Watch
67	CSDS	TECHx	Failed POV	POV		Watch
67	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
67	DeepRed	CSDS	Failed POV	POV		Watch
67	DeepRed	Disekt	Failed POV through defenses	POV		Watch
67	DeepRed	ForAllSecure	Failed POV	POV		Watch
67	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
67	DeepRed	TECHx	Failed POV	POV		Watch
67	Disekt	CodeJitsu	Failed POV through defenses	POV		Watch
67	Disekt	CSDS	Failed POV	POV		Watch
67	Disekt	DeepRed	Failed POV	POV		Watch
67	Disekt	ForAllSecure	Failed POV	POV		Watch
67	Disekt	Shellphish	Failed POV through defenses	POV		Watch
67	Disekt	TECHx	Failed POV	POV		Watch
68	CodeJitsu	Disekt	Failed POV through defenses	POV		Watch
68	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
68	CSDS	DeepRed	Failed POV	POV		Watch
68	CSDS	Disekt	Failed POV through defenses	POV		Watch
68	CSDS	ForAllSecure	Failed POV	POV		Watch
68	CSDS	Shellphish	Failed POV through defenses	POV		Watch
68	CSDS	TECHx	Failed POV	POV		Watch
68	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
68	DeepRed	CSDS	Failed POV	POV		Watch
68	DeepRed	Disekt	Failed POV through defenses	POV		Watch
68	DeepRed	ForAllSecure	Failed POV	POV		Watch
68	DeepRed	Shellphish	Failed POV through defenses	POV		Watch
68	DeepRed	TECHx	Failed POV	POV		Watch
68	Disekt	CodeJitsu	Failed POV through defenses	POV		Watch
68	Disekt	CSDS	Failed POV	POV		Watch
68	Disekt	DeepRed	Failed POV	POV		Watch
68	Disekt	ForAllSecure	Failed POV	POV		Watch
68	Disekt	Shellphish	Failed POV through defenses	POV		Watch
68	Disekt	TECHx	Failed POV	POV		Watch
69	CodeJitsu	Shellphish	Failed POV	POV		Watch
69	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
69	CSDS	DeepRed	Failed POV	POV		Watch
69	CSDS	Disekt	Failed POV through defenses	POV		Watch
69	CSDS	ForAllSecure	Failed POV	POV		Watch
69	CSDS	Shellphish	Failed POV	POV		Watch
69	CSDS	TECHx	Failed POV	POV		Watch
69	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
69	DeepRed	CSDS	Failed POV	POV		Watch
69	DeepRed	Disekt	Failed POV through defenses	POV		Watch
69	DeepRed	ForAllSecure	Failed POV	POV		Watch
69	DeepRed	Shellphish	Failed POV	POV		Watch
69	DeepRed	TECHx	Failed POV	POV		Watch
69	Disekt	CodeJitsu	Failed POV through defenses	POV		Watch
69	Disekt	CSDS	Failed POV	POV		Watch
69	Disekt	DeepRed	Failed POV	POV		Watch
69	Disekt	ForAllSecure	Failed POV	POV		Watch
69	Disekt	Shellphish	Failed POV	POV		Watch
69	Disekt	TECHx	Failed POV	POV		Watch
70	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
70	CSDS	DeepRed	Failed POV	POV		Watch
70	CSDS	Disekt	Failed POV through defenses	POV		Watch
70	CSDS	ForAllSecure	Failed POV	POV		Watch
70	CSDS	Shellphish	Failed POV	POV		Watch
70	CSDS	TECHx	Failed POV	POV		Watch
70	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
70	DeepRed	CSDS	Failed POV	POV		Watch
70	DeepRed	Disekt	Failed POV through defenses	POV		Watch
70	DeepRed	ForAllSecure	Failed POV	POV		Watch
70	DeepRed	Shellphish	Failed POV	POV		Watch
70	DeepRed	TECHx	Failed POV	POV		Watch
70	Disekt	CodeJitsu	Failed POV through defenses	POV		Watch
70	Disekt	CSDS	Failed POV	POV		Watch
70	Disekt	DeepRed	Failed POV	POV		Watch
70	Disekt	ForAllSecure	Failed POV	POV		Watch
70	Disekt	Shellphish	Failed POV	POV		Watch
70	Disekt	TECHx	Failed POV	POV		Watch
71	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
71	CSDS	DeepRed	Failed POV	POV		Watch
71	CSDS	Disekt	Failed POV through defenses	POV		Watch
71	CSDS	ForAllSecure	Failed POV	POV		Watch
71	CSDS	Shellphish	Failed POV	POV		Watch
71	CSDS	TECHx	Failed POV	POV		Watch
71	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
71	DeepRed	CSDS	Failed POV	POV		Watch
71	DeepRed	Disekt	Failed POV through defenses	POV		Watch
71	DeepRed	ForAllSecure	Failed POV	POV		Watch
71	DeepRed	Shellphish	Failed POV	POV		Watch
71	DeepRed	TECHx	Failed POV	POV		Watch
71	Disekt	CodeJitsu	Failed POV through defenses	POV		Watch
71	Disekt	CSDS	Failed POV	POV		Watch
71	Disekt	DeepRed	Failed POV	POV		Watch
71	Disekt	ForAllSecure	Failed POV	POV		Watch
71	Disekt	Shellphish	Failed POV	POV		Watch
71	Disekt	TECHx	Failed POV	POV		Watch
72	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
72	CSDS	DeepRed	Failed POV	POV		Watch
72	CSDS	Disekt	Failed POV through defenses	POV		Watch
72	CSDS	ForAllSecure	Failed POV	POV		Watch
72	CSDS	Shellphish	Failed POV	POV		Watch
72	CSDS	TECHx	Failed POV	POV		Watch
72	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
72	DeepRed	CSDS	Failed POV	POV		Watch
72	DeepRed	Disekt	Failed POV through defenses	POV		Watch
72	DeepRed	ForAllSecure	Failed POV	POV		Watch
72	DeepRed	Shellphish	Failed POV	POV		Watch
72	DeepRed	TECHx	Failed POV	POV		Watch
72	Disekt	CodeJitsu	Failed POV through defenses	POV		Watch
72	Disekt	CSDS	Failed POV	POV		Watch
72	Disekt	DeepRed	Failed POV	POV		Watch
72	Disekt	ForAllSecure	Failed POV	POV		Watch
72	Disekt	Shellphish	Failed POV	POV		Watch
72	Disekt	TECHx	Failed POV	POV		Watch
73	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
73	CSDS	DeepRed	Failed POV	POV		Watch
73	CSDS	Disekt	Failed POV through defenses	POV		Watch
73	CSDS	ForAllSecure	Failed POV	POV		Watch
73	CSDS	Shellphish	Failed POV	POV		Watch
73	CSDS	TECHx	Failed POV	POV		Watch
73	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
73	DeepRed	CSDS	Failed POV	POV		Watch
73	DeepRed	Disekt	Failed POV through defenses	POV		Watch
73	DeepRed	ForAllSecure	Failed POV	POV		Watch
73	DeepRed	Shellphish	Failed POV	POV		Watch
73	DeepRed	TECHx	Failed POV	POV		Watch
73	Disekt	CodeJitsu	Failed POV through defenses	POV		Watch
73	Disekt	CSDS	Failed POV	POV		Watch
73	Disekt	DeepRed	Failed POV	POV		Watch
73	Disekt	ForAllSecure	Failed POV	POV		Watch
73	Disekt	Shellphish	Failed POV	POV		Watch
73	Disekt	TECHx	Failed POV	POV		Watch
74	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
74	CSDS	DeepRed	Failed POV	POV		Watch
74	CSDS	Disekt	Failed POV through defenses	POV		Watch
74	CSDS	ForAllSecure	Failed POV	POV		Watch
74	CSDS	Shellphish	Failed POV	POV		Watch
74	CSDS	TECHx	Failed POV	POV		Watch
74	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
74	DeepRed	CSDS	Failed POV	POV		Watch
74	DeepRed	Disekt	Failed POV through defenses	POV		Watch
74	DeepRed	ForAllSecure	Failed POV	POV		Watch
74	DeepRed	Shellphish	Failed POV	POV		Watch
74	DeepRed	TECHx	Failed POV	POV		Watch
74	Disekt	CodeJitsu	Failed POV through defenses	POV		Watch
74	Disekt	CSDS	Failed POV	POV		Watch
74	Disekt	DeepRed	Failed POV	POV		Watch
74	Disekt	ForAllSecure	Failed POV	POV		Watch
74	Disekt	Shellphish	Failed POV	POV		Watch
74	Disekt	TECHx	Failed POV	POV		Watch
75	CSDS	CodeJitsu	Failed POV through defenses	POV		Watch
75	CSDS	DeepRed	Failed POV	POV		Watch
75	CSDS	Disekt	Failed POV through defenses	POV		Watch
75	CSDS	ForAllSecure	Failed POV	POV		Watch
75	CSDS	Shellphish	Failed POV	POV		Watch
75	CSDS	TECHx	Failed POV	POV		Watch
75	DeepRed	CodeJitsu	Failed POV through defenses	POV		Watch
75	DeepRed	CSDS	Failed POV	POV		Watch
75	DeepRed	Disekt	Failed POV through defenses	POV		Watch
75	DeepRed	ForAllSecure	Failed POV	POV		Watch
75	DeepRed	Shellphish	Failed POV	POV		Watch
75	DeepRed	TECHx	Failed POV	POV		Watch
75	Disekt	CodeJitsu	Failed POV through defenses	POV		Watch
75	Disekt	CSDS	Failed POV	POV		Watch
75	Disekt	DeepRed	Failed POV	POV		Watch
75	Disekt	ForAllSecure	Failed POV	POV		Watch
75	Disekt	Shellphish	Failed POV	POV		Watch
75	Disekt	TECHx	Failed POV	POV		Watch