NGSSoftware Insight Security Research
16/12/02, 21:38
NGSSoftware Insight Security Research Advisory
Name: PFinger Format String vulnerability
Systems: PFinger version 0.7.8 and earlier
Severity: High Risk
Vendor URL: http://www.xelia.ch/unix/pfinger/
Author: David Litchfield (david@ngssoftware.com)
Advisory URL: http://www.ngssoftware.com/advisories/pfinger.txt
Date: 16th December 2002
Advisory number: #NISR16122002B
Description
***********
PFinger is an open-source replacement of the GNU Finger daemon. PFinger
suffers from a format string vulnerability that, when exploited, can allow
the remote execution of arbitrary code.
Details
*******
The format string vulnerability arises due to an unsafe call to syslog() in
the log() function of log.c
...
syslog(level, syslog_mem);
...
To make this safe a format string should be specified:
...
syslog(level,"%s", syslog_mem);
...
Due to the way requests are logged the only way to exploit this
vulnerability is through setting the DNS name of the fingering host to the
attacker supplied format string.
h_ent = gethostbyaddr((char *)&remaddr.sin_addr, sizeof(remaddr.sin_addr),
AF_INET);
if (h_ent)
conn.hostname = strdup(h_ent->h_name);
else
conn.hostname = "(remote)";
log(LOG_INFO, "Connection from %s
(%s)",conn.hostname,inet_ntoa(remaddr.sin_addr));
This code looks up the Domain name of the fingering host and logs the
connection information. This appears to be the only place where user
controlled data is logged. For exploitation to succeed the attacker must
either control their own DNS, the DNS server of the target host or
alternatively spoof the DNS reply. This makes exploitation more difficult
but by no means impossible.
Fix Information
***************
NGSSoftware alerted the author of PFinger with this problem on the 27th of
November, 2002. The author has responded and assured NGS that a fix will be
implemented shortly. Those who are comfortable with C and cc/gcc can fix
this themselves by editing log.c in the manner described in the "Details"
section above.
A check for this issue has been added to Typhon III, NGSSoftware's advanced
vulnerability assessment tool, of which, more information is available at
the NGSSite: http://www.ngssoftware.com/
For more information about format string vulnerabilities please read
http://www.nextgenss.com/papers/win32format.doc
http://julianor.tripod.com/usfs.html
About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.
http://www.ngssoftware.com/
http://www.ngsconsulting.com/
Telephone +44 208 401 0070
Fax +44 208 401 0076
enquiries@ngssoftware.com
Name: PFinger Format String vulnerability
Systems: PFinger version 0.7.8 and earlier
Severity: High Risk
Vendor URL: http://www.xelia.ch/unix/pfinger/
Author: David Litchfield (david@ngssoftware.com)
Advisory URL: http://www.ngssoftware.com/advisories/pfinger.txt
Date: 16th December 2002
Advisory number: #NISR16122002B
Description
***********
PFinger is an open-source replacement of the GNU Finger daemon. PFinger
suffers from a format string vulnerability that, when exploited, can allow
the remote execution of arbitrary code.
Details
*******
The format string vulnerability arises due to an unsafe call to syslog() in
the log() function of log.c
...
syslog(level, syslog_mem);
...
To make this safe a format string should be specified:
...
syslog(level,"%s", syslog_mem);
...
Due to the way requests are logged the only way to exploit this
vulnerability is through setting the DNS name of the fingering host to the
attacker supplied format string.
h_ent = gethostbyaddr((char *)&remaddr.sin_addr, sizeof(remaddr.sin_addr),
AF_INET);
if (h_ent)
conn.hostname = strdup(h_ent->h_name);
else
conn.hostname = "(remote)";
log(LOG_INFO, "Connection from %s
(%s)",conn.hostname,inet_ntoa(remaddr.sin_addr));
This code looks up the Domain name of the fingering host and logs the
connection information. This appears to be the only place where user
controlled data is logged. For exploitation to succeed the attacker must
either control their own DNS, the DNS server of the target host or
alternatively spoof the DNS reply. This makes exploitation more difficult
but by no means impossible.
Fix Information
***************
NGSSoftware alerted the author of PFinger with this problem on the 27th of
November, 2002. The author has responded and assured NGS that a fix will be
implemented shortly. Those who are comfortable with C and cc/gcc can fix
this themselves by editing log.c in the manner described in the "Details"
section above.
A check for this issue has been added to Typhon III, NGSSoftware's advanced
vulnerability assessment tool, of which, more information is available at
the NGSSite: http://www.ngssoftware.com/
For more information about format string vulnerabilities please read
http://www.nextgenss.com/papers/win32format.doc
http://julianor.tripod.com/usfs.html
About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.
http://www.ngssoftware.com/
http://www.ngsconsulting.com/
Telephone +44 208 401 0070
Fax +44 208 401 0076
enquiries@ngssoftware.com