Tom's IPX Tunneling Daemon Config File Format String Vulnerability
13 Dec. 2004
Summary
tipxd is "an IPX tunneling daemon which snoops on a local network for IPX 802.3 traffic, packages it and sends it over one or many TCP/IP connections to tipxd running on remote machines where it is unpacked and sent via the local network. To the IPX networks, it then appears that the LANs are joined. This is a request for testing and big-finding. It is intended for playing IPX based games where the remote machines are joined only by a TCP/IP network, and typically when the the gaming machines are each behind a Firewall".
tipxd is affected by a locally exploitable format string bug in the tipxd_log() function found in the src/log.c file.
Vulnerable Systems:
* TipxD version 1.1.1 and prior
Vulnerable code:
45: void tipxd_log(int priority, char *format, ... )
46: {
47: va_list ap;
48: char log_entry[LOG_ENTRY_SIZE];
49:
50: /* Take the format and variables and expand them out into a string,
51: so that we can pass it on to syslog if necessary. No buffer overflow,
52: aren't I good? :)
53: */
54: va_start(ap,format);
55: vsnprintf(log_entry,LOG_ENTRY_SIZE-1,format,ap);
56:
57: if (sysinfo.opt_flags & OPT_STDERR) {
58: /* To do: add something useful like timestamping instead of silly pre-identifie
59: fprintf(stderr,"[TIPXD LOG] %s\n",log_entry);
60: } else {
61: syslog(priority,log_entry); // The format bug
62: }
63:
64: return;
65: }
Proof of concept: coki@servidor:~$ tipxd -C AAAA%08x
Unable to open configuration file : No such file or directory
coki@servidor:~$ tail -n 1 /var/log/messages
Nov 15 11:03:40 servidor tipxd[8360]: Config file is AAAA0804c8d7
coki@servidor:~$
Unoffical patch:
Change the tipxd_log() function of src/log.c code:
45: void tipxd_log(int priority, char *format, ... )
46: {
47: va_list ap;
48: char log_entry[LOG_ENTRY_SIZE];
49:
50: /* Take the format and variables and expand them out into a string,
51: so that we can pass it on to syslog if necessary. No buffer overflow,
52: aren't I good? :)
53: */
54: va_start(ap,format);
55: vsnprintf(log_entry,LOG_ENTRY_SIZE-1,format,ap);
56:
57: if (sysinfo.opt_flags & OPT_STDERR) {
58: /* To do: add something useful like timestamping instead of silly pre-identifie
59: fprintf(stderr,"[TIPXD LOG] %s\n",log_entry);
60: } else {
61: syslog(priority,"%s",log_entry); // The fix
62: }
63:
64: return;
65: }
Exploit:
/* tipxd_exp.c
TipxD Format String Vulnerability
TipxD <= 1.1.1 local exploit (Proof of Concept)
Tested in Slackware 9.0 / 9.1 / 10.0
by CoKi <coki@nosystem.com.ar> - SECU
No System Group - http://www.nosystem.com.ar
*/
