|
|
|
|
| |
| Perdition allows users to connect to a content-free POP3 or IMAP4 server that will redirect them to their real POP3 or IMAP4 server. There is a format string vulnerability in the libvanessa_logger library used by program perdition that allow remote attacker to takeover administrator's server. |
| |
Credit:
The information has been provided by GOBBLES Security.
|
| |
Vulnerable systems:
Perdition version 0.1.8 and prior
Immune systems:
Perdition version 0.1.9
Example:
$ telnet 0 110
Trying 0.0.0.0...
Connected to 0.
Escape character is '^]'.
+OK POP3 Ready freegobbles.bugtraq.org
USER GOBBLES_IS_TAKING_A_WALK_ON_HE_STACK->%p-%p-%p
+OK USER GOBBLES_IS_TAKING_A_WALK_ON_HE_STACK->%p-%p-%p set
PASS HEHEHE!
In system logs logged by program syslogd, you would notice:
Dec 18 06:23:36 freegobbles perdition[42804]: Connect: user="GOBBLES_IS_TAKING_A_WALK_ON_HE_STACK->0x8053140-0xbfbffb78-0x2807cc6c" server="(null)" port="110"
Technical details:
The following piece of code from libvanessa_logger/vanessa_logger.c shows up the vulnerable section of code:
/**********************************************************************
* vanessa_logger.c September 2000
* Horms horms@vergenet.net
*
* vanessa_logger
* Generic logging layer
* Copyright (C) 2000 Horms
...
/**********************************************************************
* __vanessa_logger_log
* Internal function to log a message
* pre: vl: logger to use
* priority: priority to log with
* Only used if log type is __vanessa_logger_syslog
* Ignored otherwise
* fmt: format for log message
* ap: varargs for format
* post: message is logged to appropriate logger
* vl->ident[pid]: will be prepended to each log
* '\n' will be appended to each log that doesn't already end with
* a '\n'
* Nothing on error
* return: none
**********************************************************************/
#define __VANESSA_LOGGER_DO_FH(_vl, _fmt, _fh, _ap) \
{ \
int len; \
if(snprintf( \
_vl->buffer, \
_vl->buffer_len-1, \
"%s[%d]: %s", \
_vl->ident, \
getpid(), \
_fmt \
)<0){ \
fprintf(_fh, "__vanessa_logger_log: snprintf: output truncated\n"); \
return; \
} \
len=strlen(_vl->buffer); \
if(*((_vl->buffer)+len-1)!='\n'){ \
*((_vl->buffer)+len)='\n'; \
*((_vl->buffer)+len+1)='\0'; \
} \
vfprintf(_fh, _vl->buffer, _ap); \
}
static void __vanessa_logger_log(
__vanessa_logger_t *vl,
int priority,
char *fmt,
va_list ap
){
if(vl==NULL||vl->ready==__vanessa_logger_false||priority>vl->max_priority){
return;
}
switch(vl->type){
case __vanessa_logger_filehandle:
__VANESSA_LOGGER_DO_FH(vl, fmt, vl->data.d_filehandle, ap);
break;
case __vanessa_logger_filename:
__VANESSA_LOGGER_DO_FH(vl, fmt, vl->data.d_filename->filehandle, ap);
break;
case __vanessa_logger_syslog:
if(vsnprintf(vl->buffer, vl->buffer_len, fmt, ap)<0){
syslog(priority, "__vanessa_logger_log: vsnprintf: output truncated");
return;
}
syslog(priority, vl->buffer);
break;
case __vanessa_logger_none:
break;
}
}
A sharp reader would note the bad syslog() usage behavior.
syslog(priority, vl->buffer);
Workaround:
It is suggested that administrators modify the libvanessa_logger.c to contain the following:
- syslog(priority, vl->buffer);
+ syslog(priority, "%s", vl->buffer);
|
|
|
|
|
