NSI Rwhoisd another Remote Format String Vulnerability
Release infomation
------------------
Release Date: 2001-11-22
Author: By NetGuard Security Team
alert7 (alert7at_private)
Homepage: http://www.netguard.com.cn/
Description
-----------
Rwhoisd is a publicly available RWHOIS server daemon for Unix based
systems developed and maintained by Network Solutions Inc.
Rwhoisd contains another remotely exploitable format string vulnerability.
It is possible to overwrite memory by syslog() if set use-syslog: YES.
$ normal default is YES
Attackers may be able to execute arbitrary code on affected hosts.
Version and Platform
--------------------
Network Solutions rwhoisd 1.5
Network Solutions rwhoisd 1.5.1a
Network Solutions rwhoisd 1.5.2
Network Solutions rwhoisd 1.5.3
Network Solutions rwhoisd 1.5.5
Network Solutions rwhoisd 1.5.6
Network Solutions rwhoisd 1.5.7.1
Network Solutions rwhoisd 1.5.7
Network Solutions rwhoisd 1.5.7-1
Network Solutions rwhoisd 1.5.7.2
Details
-------
log() function will call syslog(syslog_level,message) if set use-syslog: YES
in rwhoisd.conf file. Unfortunately,message is a user supplied format string.
demo
-----
[alert7@redhat62 ]# telnet 0 4321
Trying 0.0.0.0...
Connected to 0.
Escape character is '^]'.
%rwhois V-1.5:003fff:00 localhost.localdomain (by Network Solutions, Inc. V-1.5.7-1)
%p%p%p%p <------input
%error 230 No Objects Found
Connection closed by foreign host.
[alert7@redhat62 ]# tail /var/log/messages
Nov 21 13:04:06 redhat62 rwhoisd[27697]: CLIENT:127.0.0.1: query: 0xbffff8b00xbffff7fc0x808def80x806be4c
Nov 21 13:04:06 redhat62 rwhoisd[27697]: CLIENT:127.0.0.1: query response: 0 hits
Prove-Of-Concept exploit
------------------------
wait for vendor fix it first ;)
Vendor information
------------------
Vendor was informed at 2001-11-21
Vendor Homepage: http://www.rwhois.net/
About Netguard
--------------
China Net Security Technology Corporation (CNTC) is a leading provider of comput
er network and information security services in China.
Copyright 2001 http://www.netguard.com.cn, All rights reserved.
This archive was generated by hypermail 2b30 : Fri Nov 23 2001 - 15:25:46 PST