Shibby Tomato Stack-Based Buffer Overflow and Command Injection Vulnerability in Scheduler Component

A stack-based buffer overflow vulnerability has been identified in Shibby Tomato version 1.28, specifically within the Scheduler Name Handler component. The issue arises in the function 'sub_42537C', where the manipulation of the 'a1' argument leads to a buffer overflow. This vulnerability can be exploited remotely, allowing for potential command injection via the 'system()' function.

Impact

Exploitation of this vulnerability can cause a crash of the 'sbin/rc' scheduler service, overwrite the saved return address on the stack, and potentially execute arbitrary code. Additionally, it introduces a command injection risk through the 'system()' function, especially if the 'a1' argument contains shell metacharacters.

Reproduction

The vulnerability can be reproduced by invoking the 'sched_main' function with a crafted scheduler name that exceeds 64 bytes. This can be done by using a 'sch_c' name that passes a numeric prefix but retains shell metacharacters, such as 'sch_c1;touch /tmp/pwned;'. The 'sub_42537C' function will then process the oversized name, leading to a buffer overflow.