Subject: Re: remote root overflow ?

From: Dan Foster <[email-masked]>
Date: Wed, 10 Feb 1999 17:38:57 -0500 (EST)

Hot Diggety! On a bright and sunny day, Bernhard Rosenkraenzer was rumored to have said...
> On Wed, 10 Feb 1999, Robertson, Rocke wrote:
> 
> > I just received an email concerning an advisory that certain  ftp
> > servers are vulnerable to  attacks, I believe them to be denial of
> > service attacks. They claim that wuftp beta 18 is vulnerable on most
> > Unix platforms.
> 
> The problem is present in beta18; but it has fixed months ago in both the
> VR version and BeroFTPD.

So, what was the exact fix, if you remember? It'd probably be of some use
to those of who who still runs beta18 and not one of the derivatives.

-Dan

---

From: "Robertson, Rocke" <[email-masked]>
Date: Wed, 10 Feb 1999 15:13:28 -0500

I just received an email concerning an advisory that certain  ftp
servers are vulnerable to  attacks, I believe them to be denial of
service attacks. They claim that wuftp beta 18 is vulnerable on most
Unix platforms. I have not hear of this being discussed on this mail
list.

The advisory came from Netec In. It is a General Public Security
Advisory...?

Has anyone heard of this dos ? Should we be concerned if we are using
wuftpd on Solaris 2.6 ?

Thanks

--
Rocke Robertson
PWGSC/GTIS
(613)991-2604
[email-masked]

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 10 Feb 1999 16:23:37 -0500 (EST)

> Unix platforms. I have not hear of this being discussed on this mail

It has been, including a pre-release of the Netect advisory.

The original discussion, though, was about 6 months ago on Bugtraq.

> The advisory came from Netec In. It is a General Public Security

It's an advisory.  It's not from CERT, though.  Take that to mean what you
will.

My feeling is this; Aleph approved it for Bugtraq .. I'd pay attention. He
has reason to trust Netect and that's good enough for me.

> Has anyone heard of this dos ? Should we be concerned if we are using

It's not a DoS, it's a potential rootshell.

I had a long discussion with the folk at Netect about this, first pointing
them to the history (which they'd missed on Bugtraq as well) then
discussing whenther they could actually inject any code into the
root-running daemon.  They have a test which showed that they could inject
enough garbage to crash the daemon. To them, that means it's only a matter
of hard work to inject a rootshell.

It doesn't only effect FTP daemons.  It also effects all platforms whose
realpath() which has not been corrected.  Wu-FTPD was effected because it
includes a private copy of realpath().  This copy is not used on all
systems; it IS used on Solaris systems.

I told Netect that the best course is to assume wu-ftpd is vulnerable; if
it uses its local copy of realpath() it is; otherwise you don't know and
have to ask the OS vendor.

If you're not the target architecture, it'll look like a DoS.  Of course,
a DoS for wu-ftpd isn't much good if you're running from inetd since the
only person you can deny is yourself.

Should you be concerned on Solaris 2.6?  Definitely.  Unless you're
already running VR10 or later, or BeroFTPD 1.2.0 or later.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 10 Feb 1999 17:56:33 -0500 (EST)

On Wed, 10 Feb 1999, Dan Foster wrote:

> So, what was the exact fix, if you remember? It'd probably be of some
> use to those of who who still runs beta18 and not one of the
> derivatives.

The realpath() code was such a pile of crap, Bernard and I talked about it
and decided it had to go.  He did the work.  A complete replacement with
a non-vulnerable version from some flavor of BSD.

Here's the fix RedHat is using.  Whether it's complete or not is
debatable.  Frankly, it doesn't look to me like it fixes the entire
problem, just the enough to pass Netect's test.  Remember, though we fixed
this problem long before there was a test for it.

Use --ignore-whitespace on this and watch for linewraps, I'm using
cut-n-paste:

--- wu-ftpd-2.4.2-beta-18/src/realpath.c.security       Mon Jul  6 05:14:39 1998
+++ wu-ftpd-2.4.2-beta-18/src/realpath.c        Mon Jan 18 19:16:45 1999
@@ -40,6 +40,7 @@
 #include <sys/stat.h>
 #include <sys/param.h>
 #include <string.h>
+#include <syslog.h>
 
 #ifndef HAVE_SYMLINK
 #define lstat stat
@@ -143,7 +144,13 @@
             continue;
         if ((last == namebuf) || (*--last != '/'))
             strcat(namebuf, "/");
-        strcat(namebuf, where);
+       if (strlen(namebuf)+strlen(where) < sizeof(namebuf)) {
+           strcat(namebuf, where);
+       } else {
+           /* The path name is too long... bail out */
+           strcpy(result, "\0");
+           return NULL;
+       }
 
         where = ++ptr;
         if (lstat(namebuf, &sbuf) == -1) {
@@ -164,7 +171,13 @@
                 *workpath = '\0';
             if (*where) {
                 strcat(linkpath, "/");
-                strcat(linkpath, where);
+               if (strlen(linkpath) + strlen(where) < sizeof(linkpath)) {
+                   strcat(linkpath, where);
+               } else {
+                   /* path too long... bail out --cristiang */
+                   strcpy(result, "\0");
+                   return(NULL);
+               }
             }
             strcpy(curpath, linkpath);
             goto loop;

--

---

From: Bret McDanel <[email-masked]>
Date: Wed, 10 Feb 1999 16:37:48 -0500

---Reply on mail from Robertson, Rocke about remote root overflow ?

> The advisory came from Netec In. It is a General Public Security
if that is the one I am thinking of, it said that vr10 (and above) isnt
vunerable, it also said that it was a filename issue..  You may want to
upgrade to fix that (and a few other things)..

netec has the advisory on their page (www.netec.com I believe)

-- 
Bret McDanel                                    http://www.rehost.com
Realistic Technologies, Inc.                             973-514-1144

     These opinions are mine, and may not be the same as my employer

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Wed, 10 Feb 1999 22:23:20 +0100 (CET)

LLaP
bero

-- 
Windows 98 supports real multitasking - it can boot and crash simultaneously.
***
Anyone sending unwanted advertising e-mail to this address will be charged
$25 for network traffic and computing time. By extracting my address from
this message or its header, you agree to these terms.