NcFTP - password leaking

[Konstantin Gavrilenko]

Arhont Ltd. - Information Security

Arhont Advisory by: Konstantin Gavrilenko (http://www.arhont.com)
Advisory: ncftp password not hashed in processes list
Class: design bug
Version: 3.1.6/120, 3.1.7/120
Test platform: Slackware 9.1, Debian unstable
Model Specific: Other version might have the same bug
Vendor Contact Date: 13/04/2004
PD* release date: 20/04/2004


DETAILS:

ncftp client does not hash the password under certain conditions. And
such information is made available to other users through `ps aux`

e.g.
when the link is hacked up to include username and password in one line
like ftp://testuser:testpassword@filo.dmz.arhont.com/
ncftp client is able to interpret such format and successfully
connects to the site.

root@dyno:~# ncftp ftp://testuser:testpassword@filo.dmz.arhont.com/
NcFTP 3.1.7 (Jan 07, 2004) by Mike Gleason (http://www.NcFTP.com/contact/).
Connecting to 192.168.66.102...
ProFTPD 1.2.8 Server (ProFTPD Default Installation) [filo.dmz.arhont.com]
Logging in...
User testuser logged in.
Logged in to filo.dmz.arhont.com.
Current remote directory is /home/testuser.
ncftp /home/testuser >


However, the full link is displayed in the `ps aux` output,
providing unauthorised display of the sensitive data.


root 798 0.0 0.1 2020 1064 pts/3 S 15:04 0:00 ncftp
ftp://testuser:testpassword@filo.dmz.arhont.com/
g_kos 802 0.0 0.2 3504 2476 pts/4 S 15:04 0:00 -su
g_kos 2854 0.0 0.0 2636 756 pts/4 R 15:27 0:00 ps aux


Risk Factor: High

Workarounds: Avoid using links formed in such way.

The vendor has been contacted on 13/04/2004 and has assured that issue
will be corrected in the next ncftp release.


*According to the Arhont Ltd. policy, all of the found vulnerabilities
and security issues will be reported to the manufacturer 7 days before
releasing them to the public domains (such as CERT, BUGTRAQ, OSVDB).

If you would like to get more information about this issue, please do
not hesitate to contact Arhont team.




--
Respectfully,
Konstantin V. Gavrilenko

Arhont Ltd - Information Security

web: http://www.arhont.com
http://www.wi-foo.com
e-mail: k.gavrilenko@arhont.com

tel: +44 (0) 870 44 31337
fax: +44 (0) 117 969 0141

PGP: Key ID - 0x4F3608F7
PGP: Server - keyserver.pgp.com

[Frank v Waveren]

On Tue, Apr 20, 2004 at 12:46:10AM +0100, Konstantin Gavrilenko wrote:
> ncftp client does not hash the password under certain conditions. And
> such information is made available to other users through `ps aux`
[snip]
> root 798 0.0 0.1 2020 1064 pts/3 S 15:04 0:00 ncftp
> ftp://testuser:testpassword@filo.dmz.arhont.com/

I assume by hashing you mean scribbling over the password value in
ARGV? That still leaves a race condition where the password is visible
between the execve and the overwriting; There is no secure way of
passing secrets on the commandline on a multiuser unix system. Use a
file descriptor or a file (either of which can ofcourse be referenced
on the command line).

--
Frank v Waveren Fingerprint: 9106 FD0D
fvw@[var.cx|stack.nl] ICQ#10074100 D6D9 3E7D FAF0 92D1
Public key: hkp://wwwkeys.pgp.net/8D54EB90 3931 90D6 8D54 EB90

[Alex Behar]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tuesday 20 April 2004 02:46, Konstantin Gavrilenko wrote:

> ncftp client does not hash the password under certain conditions. And
> such information is made available to other users through `ps aux`

> Risk Factor: High

Wget (1.8.2 and earlier) and lftp (2.6.11 and earlier) have the very same=20
"vulnerability". I doubt thats a problem worth posting an advisory over. Bo=
th=20
lftp and ncftp can be runned in interactive mode and the details entered=20
inside, so no information is disclosed to "ps". Also, in wget, you can use=
=20
the --input-file=3D<filename> option which allows you to put the URLs in=20
ftp://user:pass@host/ format, one at a line in a file. Note that there will=
=20
be still info on the harddrive (unless you remove the URL list from the dis=
k=20
after running the application is runned).
In wget there isnt a way around that, so there it might be more of a=20
"vulnerability" then ncftp or lftp.


Alex
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAhWu7fDQ3s2iW3q0RAo89AJ0SuQgXKX5DODvUaiRDsp 2/ZcJUCQCgw3/8
kTc+rq+E+wScAubqreOhkss=3D
=3DxqeS
=2D----END PGP SIGNATURE-----