full-disclosure - [TZO-072006]-Xampp - Multiple Priviledge Escalation (SYSTEM) and Rogue Autostart

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun May 21 17:57:58 2006
From: Thierry at Zoller.lu (Thierry Zoller)
Subject: [TZO-072006]-Xampp - Multiple Priviledge
	Escalation (SYSTEM) and Rogue Autostart

_______________________________________________________________________

       XAMPP - Multiple Priviledge Escalation and Rogue Autostart
_______________________________________________________________________

Ref     : TZO-072006-Xampp
Author  : Thierry Zoller 
WWW     : http://secdev.zoller.lu
Article : http://secdev.zoller.lu/research/xamp1.htm

I. Background
~~~~~~~~~~~~~
XAMPP is an easy to install Apache distribution containing MySQL, PHP 
and Perl. XAMPP  is really  very easy to  install and to  use  - just 
download, extract and start. In the FAQ we read : Xampp  is not meant
for  production  use  but  only  for  developers  in  a   development 
environment.  However  I   have seen  it  being  used  in  production 
environments  quite a lot,hence this advisory.

According to the download stats, Xampp has  been downloaded 2.765.443 
times between 2003 and 2006 

[1] Priviledge Escaltation to SYSTEM due to FileZilla Service Path 
    specification - CVSS Rating : 4 
[2] Priviledge Escaltation to SYSTEM due to MySQLadmin Path 
    specification - CVSS Rating : 4
[3] Priviledge Escaltation to SYSTEM due to CGI Path specification
    - CVSS Rating : 4
[4] Rogue Autostart due to unsecure File execution 
    - CVSS Rating : 2.8

II. Details
~~~~~~~~~~~~~

[1] Priviledge Escaltation to SYSTEM due to FileZilla Service Path specification :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- The default installation path used during installation of Xampp 
  1.5.2 is "c:\program files" 
- The path specified in the service image is not being quoted :

As such as soon as the service is started, the Path not being quoted, 
c:\program.exe   is  executed  with   NT/SYSTEM rights  (The one the 
filezillaftp service would have had).  If we  create a program named
c:\program.exe that shells NETCAT (and mysql)  which  spawns a shell
to a remote host, we have SYSTEM acces remotely.

[2] Priviledge Escaltation to SYSTEM due to MySQLadmin Path specification
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- The default installation path used during installation of Xampp 
1.5.2 is "c:\program files" 
- The MYSSQLAdmin 1.4 console comes with a messed up configuration
  file, first the  "/" character instead of "\"is used to indicate 
  the path to the executable, furthermore  the  path is not quoted,
  resulting  in yet  another priviledge escalation  situation, if 
  the user launches the Mysql Admin console.

As the user clicks "Admin.." to launch the MySqlAdmin interface, the
Path not being quoted in the configuration file , c:\program.exe 
is executed with NT/SYSTEM rights.

[3] Priviledge Escaltation to SYSTEM due to CGI Path specification
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- The default installation path used during installation of Xampp 
  1.5.2 is "c:\program files" 
- Apache runs as a service
- An user clicks on STATUS in the XAMMPP control panel or calls a
  CGI script over http.

As the user clicks on the Status link inside the control panel 
or executes a CGI program with the same path specified , 
c:\program.exe is executed with NT/SYSTEM rights if apache 
runs as a service.

[4] Rogue Autostart due to unsecure File execution 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- The default installation path used during installation of Xampp 
  1.5.2 is "c:\program files" 

During Startup, the installer executes  the xampp  control panel 
through the use  of the CreateProcess()  function.  By doing so 
it omits  to set the 'lpApplicationName'  variable and  further 
omits to quote the path in the variable "lpCommandLine". Ref [1]

This results  in c:\program.bat|exe|com  being called  prior to 
xamppcontrol.exe and allows automatic startup  of a potentially
rogue application. 

III. Vendor Response
~~~~~~~~~~~~~~~~~~~~
http://www.apachefriends.org/en/news-article,75557.html

[06/May] Vendor Contact
[07/May] Vendor Response
[09/May] The current Windows beta fixes two of the problems based on
         this bug. We expect the next beta soon which will fix all
         four problems.
[10/May] The new Windows beta now fixes all problems.

IV. MISC
~~~~~~~~~~~~~~~~~~~~
[1] http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038789.html
[2] Only a real issue in Windows 2000, WinXP restricted users don't have the right to write to c:\

-- 
http://secdev.zoller.lu
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7