86481 2002-12-10 19:45 /203 rader/ dong-h0un U <xploit@hackermail.com>
Importerad: 2002-12-10 19:45 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <2698>
Ärende: Remote multiple vulnerability in apt-www-proxy.
------------------------------------------------------------
========================================
INetCop Security Advisory #2002-0x82-009
========================================
* Title: Remote multiple vulnerability in apt-www-proxy.
0x01. Description
__
bash$ lynx -dump http://ironsides.terrabox.com/~ahzz/apt-www-proxy/
apt-www-proxy
apt-www-proxy is a proxy server designed specificly for apt-get
http:// repositories. It gathers files that clients request, and
then simultaneously retrieves, streams to client, and to local
disk archive based on a set of archive mappings a lot like
apt-proxy does. I decided to write this due to the unstable nature
of apt-proxy. IMHO this is due to it being written in shell
script. It's a good design, just was never implemented in the
right kind of language.
[1]apt-www-proxy 0.1 - accepts clients and automaticly says "not
found". nifty eh? 8-P
And of course, who would be without the [2]latest snapshot!
Back to my [3]homepage!
References
1. http://ironsides.terrabox.com/~ahzz/apt-www-proxy/apt-www-proxy-0.1.tar.gz
2. http://ironsides.terrabox.com/~ahzz/apt-www-proxy/latest-AWP.tar.bz2
3. http://ironsides.terrabox.com/~ahzz/index.html
bash$
--
OK, Let's analyze.
Examine syslog() function first.
There is awp_log() function to 173 lines of 'src/utils.c' code.
__
173 void awp_log(int level, const char *message)
...
222 if((level < LOG_DEBUG) || (1 == logit))
224 /* log that information */
227 syslog(level, message); // Here.
...
--
It's very bad state.
awp_log() function is used as follows.
Format string bug happens by setting file error log.
Let's find awp_log() function in 'apt-www-proxy.c' code.
__
47 awp_log(LOG_DATA, errlog);
78 awp_log(LOG_DATA, errlog);
93 awp_log(LOG_DATA, errlog);
130 awp_log(LOG_DATA, errlog);
146 awp_log(LOG_DATA, errlog);
157 awp_log(LOG_GEN, errlog);
287 awp_log(LOG_NOTICE, errlog);
500 awp_log(LOG_NOTICE,errlog);
510 awp_log(LOG_CRIT, errlog);
527 awp_log(LOG_ERR, errlog);
538 awp_log(LOG_INFO, errlog);
546 awp_log(LOG_NOTICE, errlog);
554 awp_log(LOG_NOTICE, errlog);
560 awp_log(LOG_NOTICE, errlog);
572 awp_log(LOG_NOTICE, errlog);
--
Second, examine remote DoS vulnerability.
We read 'utils.c' code again.
__
260 int parse_get(struct client * client)
...
268 /* now match against the archives */
269 if(!strncmp("http://", client->get, 7)) // Here.
270 {
271 /* AHHA! It's a full URL. */
--
If 'client->get' value is NULL, strncmp() function segfault happens
crash. Program function execution structure is as following.
----------------------------------------------------------------------
main()->main_loop()->process_cli()->parse_get()->strncmp()->'segfault'
----------------------------------------------------------------------
0x02. Vulnerable Packages
Vendor site: http://ironsides.terrabox.com/~ahzz/apt-www-proxy/
apt-www-proxy 0.1
-apt-www-proxy-0.1.tar.gz
+Linux
0x03. Exploit
Try simple test.
* Test -
First, execute apt-www-proxy daemon.
Do debug in other shell thereafter.
#1) Test attacker:
bash$ (printf "\r\n";cat)|nc 0 6543
#2) Debugging:
Program received signal SIGSEGV, Segmentation fault.
strncmp (s1=0x804b730 "http://", s2=0x0, n=7)
at ../sysdeps/generic/strncmp.c:43
43 ../sysdeps/generic/strncmp.c: No such file or directory.
(gdb) bt
#0 strncmp (s1=0x804b730 "http://", s2=0x0, n=7)
at ../sysdeps/generic/strncmp.c:43
#1 0x804a9f3 in parse_get (client=0x80516c8) at utils.c:269
#2 0x804a176 in process_cli (reads={__fds_bits = {64, 0 <repeats 31 times>}},
writes={__fds_bits = {64, 0 <repeats 31 times>}}) at lists.c:270
#3 0x8049750 in main_loop (s=5) at apt-www-proxy.c:408
#4 0x8049b56 in main (argc=3, argv=0xbffffbe4,
arge=0xbffffbf4 ...) at apt-www-proxy.c:578
(gdb)
You can kill daemon through this.
Do you want exploit code? Very regrettable. :-(
We don't want to compose DoS code.
0x04. Patch
=== utils.patch ===
--- utils.c Mon Oct 22 15:20:29 2001
+++ utils.patch.c Sat Nov 30 02:26:35 2002
@@ -224,11 +224,11 @@
/* log that information */
if(background)
{
- syslog(level, message);
+ syslog(level, "%s", message);
}
else
{
- fprintf(stderr, message);
+ fprintf(stderr, "%s", message);
}
}
}
@@ -265,6 +265,10 @@
struct urlmask *curu = urls;
int found = 0;
+ if(client->get==NULL)
+ {
+ return(0);
+ }
/* now match against the archives */
if(!strncmp("http://", client->get, 7))
{
=== eof ===
P.S: Sorry, for my poor english.
--
By "dong-houn yoU" (Xpl017Elz), in INetCop(c) Security.
MSN & E-mail: szoahc(at)hotmail(dot)com,
xploit(at)hackermail(dot)com
INetCop Security Home: http://www.inetcop.org (Korean hacking game)
My World: http://x82.i21c.net
GPG public key:
http://wizard.underattack.co.kr/~x82/h0me/pr0file/x82.k3y
--
--
_______________________________________________
Get your free email from http://www.hackermail.com
Powered by Outblaze
(86481) /dong-h0un U <xploit@hackermail.com>/(Ombruten)
86559 2002-12-11 23:31 /173 rader/ dong-h0un U <xploit@hackermail.com>
Importerad: 2002-12-11 23:31 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <2716>
Ärende: Remote multiple vulnerability in apt-www-proxy.
------------------------------------------------------------
========================================
INetCop Security Advisory #2002-0x82-009
========================================
* Title: Remote multiple vulnerability in apt-www-proxy.
0x01. Description
__
bash$ lynx -dump http://ironsides.terrabox.com/~ahzz/apt-www-proxy/
apt-www-proxy
apt-www-proxy is a proxy server designed specificly for apt-get
http:// repositories. It gathers files that clients request, and
then simultaneously retrieves, streams to client, and to local
disk archive based on a set of archive mappings a lot like
apt-proxy does. I decided to write this due to the unstable nature
of apt-proxy. IMHO this is due to it being written in shell
script. It's a good design, just was never implemented in the
right kind of language.
[1]apt-www-proxy 0.1 - accepts clients and automaticly says "not
found". nifty eh? 8-P
And of course, who would be without the [2]latest snapshot!
Back to my [3]homepage!
References
1. http://ironsides.terrabox.com/~ahzz/apt-www-proxy/apt-www-proxy-0.1.tar.gz
2. http://ironsides.terrabox.com/~ahzz/apt-www-proxy/latest-AWP.tar.bz2
3. http://ironsides.terrabox.com/~ahzz/index.html
bash$
--
OK, Let's analyze.
Examine syslog() function first.
There is awp_log() function to 173 lines of 'src/utils.c' code.
__
173 void awp_log(int level, const char *message)
...
222 if((level < LOG_DEBUG) || (1 == logit))
224 /* log that information */
227 syslog(level, message); // Here.
...
--
It's very bad state.
awp_log() function is used as follows.
Format string bug happens by setting file error log.
Let's find awp_log() function in 'apt-www-proxy.c' code.
__
47 awp_log(LOG_DATA, errlog);
78 awp_log(LOG_DATA, errlog);
93 awp_log(LOG_DATA, errlog);
130 awp_log(LOG_DATA, errlog);
146 awp_log(LOG_DATA, errlog);
157 awp_log(LOG_GEN, errlog);
287 awp_log(LOG_NOTICE, errlog);
500 awp_log(LOG_NOTICE,errlog);
510 awp_log(LOG_CRIT, errlog);
527 awp_log(LOG_ERR, errlog);
538 awp_log(LOG_INFO, errlog);
546 awp_log(LOG_NOTICE, errlog);
554 awp_log(LOG_NOTICE, errlog);
560 awp_log(LOG_NOTICE, errlog);
572 awp_log(LOG_NOTICE, errlog);
--
Second, examine remote DoS vulnerability.
We read 'utils.c' code again.
__
260 int parse_get(struct client * client)
...
268 /* now match against the archives */
269 if(!strncmp("http://", client->get, 7)) // Here.
270 {
271 /* AHHA! It's a full URL. */
--
If 'client->get' value is NULL, strncmp() function segfault happens
crash. Program function execution structure is as following.
----------------------------------------------------------------------
main()->main_loop()->process_cli()->parse_get()->strncmp()->'segfault'
----------------------------------------------------------------------
0x02. Vulnerable Packages
Vendor site: http://ironsides.terrabox.com/~ahzz/apt-www-proxy/
apt-www-proxy 0.1
-apt-www-proxy-0.1.tar.gz
+Linux
0x03. Exploit
Do you want exploit code? Very regrettable. :-(
We don't want to compose DoS code.
0x04. Patch
=== utils.patch ===
--- utils.c Mon Oct 22 15:20:29 2001
+++ utils.patch.c Sat Nov 30 02:26:35 2002
@@ -224,11 +224,11 @@
/* log that information */
if(background)
{
- syslog(level, message);
+ syslog(level, "%s", message);
}
else
{
- fprintf(stderr, message);
+ fprintf(stderr, "%s", message);
}
}
}
@@ -265,6 +265,10 @@
struct urlmask *curu = urls;
int found = 0;
+ if(client->get==NULL)
+ {
+ return(0);
+ }
/* now match against the archives */
if(!strncmp("http://", client->get, 7))
{
=== eof ===
P.S: Sorry, for my poor english.
--
By "dong-houn yoU" (Xpl017Elz), in INetCop(c) Security.
MSN & E-mail: szoahc(at)hotmail(dot)com,
xploit(at)hackermail(dot)com
INetCop Security Home: http://www.inetcop.org (Korean hacking game)
My World: http://x82.i21c.net
GPG public key:
http://wizard.underattack.co.kr/~x82/h0me/pr0file/x82.k3y
--
--
_______________________________________________
Get your free email from http://www.hackermail.com
Powered by Outblaze
(86559) /dong-h0un U <xploit@hackermail.com>/(Ombruten)