NGSSoftware Insight Security Research Advisory Name: PFinger Format String vulnerability Systems: PFinger version 0.7.8 and earlier Severity: High Risk Vendor URL: http://www.xelia.ch/unix/pfinger/ Author: David Litchfield (davidat_private) Advisory URL: http://www.ngssoftware.com/advisories/pfinger.txt Date: 16th December 2002 Advisory number: #NISR16122002B Description *********** PFinger is an open-source replacement of the GNU Finger daemon. PFinger suffers from a format string vulnerability that, when exploited, can allow the remote execution of arbitrary code. Details ******* The format string vulnerability arises due to an unsafe call to syslog() in the log() function of log.c .. syslog(level, syslog_mem); .. To make this safe a format string should be specified: .. syslog(level,"%s", syslog_mem); .. Due to the way requests are logged the only way to exploit this vulnerability is through setting the DNS name of the fingering host to the attacker supplied format string. h_ent = gethostbyaddr((char *)&remaddr.sin_addr, sizeof(remaddr.sin_addr), AF_INET); if (h_ent) conn.hostname = strdup(h_ent->h_name); else conn.hostname = "(remote)"; log(LOG_INFO, "Connection from %s (%s)",conn.hostname,inet_ntoa(remaddr.sin_addr)); This code looks up the Domain name of the fingering host and logs the connection information. This appears to be the only place where user controlled data is logged. For exploitation to succeed the attacker must either control their own DNS, the DNS server of the target host or alternatively spoof the DNS reply. This makes exploitation more difficult but by no means impossible. Fix Information *************** NGSSoftware alerted the author of PFinger with this problem on the 27th of November, 2002. The author has responded and assured NGS that a fix will be implemented shortly. Those who are comfortable with C and cc/gcc can fix this themselves by editing log.c in the manner described in the "Details" section above. A check for this issue has been added to Typhon III, NGSSoftware's advanced vulnerability assessment tool, of which, more information is available at the NGSSite: http://www.ngssoftware.com/ For more information about format string vulnerabilities please read http://www.nextgenss.com/papers/win32format.doc http://julianor.tripod.com/usfs.html About NGSSoftware ***************** NGSSoftware design, research and develop intelligent, advanced application security assessment scanners. Based in the United Kingdom, NGSSoftware have offices in the South of London and the East Coast of Scotland. NGSSoftware's sister company NGSConsulting, offers best of breed security consulting services, specialising in application, host and network security assessments. http://www.ngssoftware.com/ http://www.ngsconsulting.com/ Telephone +44 208 401 0070 Fax +44 208 401 0076 enquiriesat_private
This archive was generated by hypermail 2b30 : Wed Dec 18 2002 - 17:04:37 PST