-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



@stake, Inc.
www.atstake.com

Security Advisory

Advisory Name: Mac OS X pppd format string vulnerability
Release Date: 02/23/2004
Application: pppd 2.4.0
Platform: Mac OS X 10.3.2 and below
Severity: Local users are able to retrieve PAP/CHAP credentials
Author: Dave G. <daveg@atstake.com>
Vendor Status: Vendor has security update=20
CVE Candidate: CAN-2004-0165
Reference: http://www.atstake.com/research/advi.../a022304-1.txt


Overview:=20

The ppp daemon that comes installed by default in Mac OS X=20
is vulnerable to a format string vulnerability. The vulnerability is
in a function specific to pppd that does not allow for traditional
exploitation (arbitrary data written to arbitrary memory locations)
via %n. However, it is possible to read arbitrary data out of pppd's
process. Under certain circumstances, it is also possible to 'steal'
PAP/CHAP authentication credentials.

=20
Details:=20

When pppd receives an invalid command line argument, it will
eventually pass it as a format specifier to vslprintf(). This
function is a custom replacement for vsnprintf(), and does contains a
small subset of the format specifiers. The offending function is
called option_error:

void
option_error __V((char *fmt, ...))
{
va_list args;
char buf[256];

#if defined(__STDC__)
va_start(args, fmt); =20
#else
char *fmt;
va_start(args);
fmt =3D va_arg(args, char *);
#endif
vslprintf(buf, sizeof(buf), fmt, args);
va_end(args);
if (phase =3D=3D PHASE_INITIALIZE) =20
fprintf(stderr, "%s: %s\n", progname, buf);
#ifdef __APPLE__
error(buf);
#else
syslog(LOG_ERR, "%s", buf);
#endif
}

As we can see, there is a specific Apple ifdef that will pass our
buffer directly to error(). =20

By utilizing one of the techniques outlined in scut's paper,
"Exploiting Format String Vulnerabilities", it may be possible to
access PAP and/or CHAP credentials, if the OS X system is being used
as a PPP server.


Vendor Response:

This is fixed in Security Update 2004-02-23 for Mac OS X 10.3.2 and
Mac OS X 10.2.8. Information about Apple Security Updates may be
found at http://www.info.apple.com/


Recommendation:

Install the vendor supplied upgrade.


Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned=20
the following names to these issues. These are candidates for=20
inclusion in the CVE list (http://cve.mitre.org), which standardizes=20
names for security problems.

CAN-2004-0165 Mac OS X pppd format string vulnerability


@stake Vulnerability Reporting Policy:=20
http://www.atstake.com/research/policy/

@stake Advisory Archive:
http://www.atstake.com/research/advisories/

PGP Key:
http://www.atstake.com/research/pgp_key.asc

Copyright 2004 @stake, Inc. All rights reserved.





-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3

iQA/AwUBQDqNV0e9kNIfAm4yEQJDyACfdyoktRpVe2HdeJ+OXFrO0P CH5L4Anj1t
ayzDBWIsuXib+mhqIjrG7wDI
=3D4K2F
-----END PGP SIGNATURE-----