Message-Id: <201511300308.tAU389O9009343@sf01web1.securityfocus.com>
Date: Mon, 30 Nov 2015 03:08:09 GMT
From: lem.nikolas@...il.com
To: bugtraq@...urityfocus.com
Subject: Proftpd 1.3.5a LATEST 0day Follow-up report (Part 2), Patch
 released!! 29/11/2015 --- Advanced Information Security Corporation

 ===============================================
                       Credit: Nicholas Lemonias


              .::PROFTPD  v1.3.5a  HEAP OVERFLOWS / MALLOC CORRUPTION ::.


 ADVANCED INFORMATION SECURITY CORPORATION

                                                     Keeping Things Simple!

 ======================================================


                   .88888888:.
                  88888888.88888.
                .8888888888888888.
                888888888888888888
                888' _`888'_  `88888
                888 888 888  88888
                888_888_::_888_:888
                888:::,::,:::::8888
                888`:::::::::'`8888
               .888  `::::'    8:88.
              8888            `8:888.
            .8888'             `888888.
           .8888:..  .::.  ...:'8888888:.
          .8888.'     :'     `'::`88:88888
         .8888        '         `.888:8888.
        888:8         .           888:88888
      .888:88        .:           888:88888:
      8888888.       ::           88:888888
      `.::.888.      ::          .88888888
     .::::::.888.    ::         :::`888'.:.
    ::::::::::.888   '         .::::::::::::
    ::::::::::::.8    '      .:8::::::::::::.
 .::::::::::::::.        .:888:::::::::::::
 :::::::::::::::888:.__..:88888:::::::::::'
    `'.:::::::::::88888888888.888:::::::::'
          `':::_:' -- '' -'-' `':_::::'`.



==================
INTRODUCTION
==================

  ProFTPD is Free and open-source software, compatible with Unix-like
  systems and Microsoft Windows (via Cygwin). Along with vsftpd and
  Pure-FTPd, ProFTPD is among the most popular FTP servers in Unix-like
  environments today. Compared to those, which focus e.g. on simplicity,
  speed or security, ProFTPD's primary design goal is to be a highly
  feature rich FTP server, exposing a large amount of configuration
  options to the user


  ====================================================
  Description: During a manual source code audit of ProFTPD latest,
  various security issues were discovered. [3]
  =====================================================


 ===========================
 CODE SNIPPET (PoC 1)
 ===========================
  ../../mod_sftp/fxp.c:1217-1251


 static struct fxp_extpair *fxp_msg_read_extpair(pool *p, unsigned char **buf,
     uint32_t *buflen) {
   uint32_t namelen, datalen;
   unsigned char *name, *data;
   struct fxp_extpair *extpair;
   namelen = sftp_msg_read_int(p, buf, buflen);
   if (*buflen < namelen) {
     (void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
       "SFTP message format error: unable to read %lu bytes of extpair name "
       "data (buflen = %lu)", (unsigned long) namelen, (unsigned long) *buflen);
     SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
   }
   name = palloc(p, namelen + 1);
   memcpy(name, *buf, namelen);
   (*buf) += namelen;
   (*buflen) -= namelen;
   name[namelen] = '\0';
   datalen = sftp_msg_read_int(p, buf, buflen);
   if (datalen > 0) {
     data = sftp_msg_read_data(p, buf, buflen, datalen);
   } else {
     data = NULL;
   }
   extpair = palloc(p, sizeof(struct fxp_extpair));
   extpair->ext_name = (char *) name;
   extpair->ext_datalen = datalen;
   extpair->ext_data = data;
   return extpair;
 }

 =====================
 RATIONALE
 =====================


 Part of the SFTP handshake involves "extensions", which are key/value
 pairs, comprised of strings.  In SSH, strings are encoded for network
 transport as a 32-bit length, followed by the bytes.

 The mod_sftp module has no manual bounds/length metrics / limitations
 when reading SFTP extension key/value data from the network.


   A malicious attacker might attempt to encode large values, and
 allocate more memory than is necessary, resulting in uncontrollable
 memory exhaustion / and resource consumption.



 =======================
 CONCLUSION
 =======================

 To avoid undue resource exhaustion by a remote client, mod_sftp should
 include a patch on the maximum length of acceptable extension
 keys/values, as reported by our earlier Proftpd report.


 REPORT TIMELINE
 ==============================
 22/11/2015  Reported to vendor. (Initial Report)  [3]
 25/11/2015  Second report to vendor.

 29/11/2015  Bug Report / Patch circulation.


 Big thanks to TJ from Proftpd for the prompt response to the issue,
 and excellent cooperation in security.



  ==============================
  ACKNOWLEDGEMENTS
  ==============================

 PacketStorm Security
 TEAM TESO, w00w00, Netric, b0iler (eyeonsecurity), wootehfoot,
 badpack3t (SP), Vandal (Vic), s0kket, mantis, Big_Al , ELFQrin, bob
 (dtors),  epic, RaT  for their ~ legendary mark.




 ====================
 REFERENCES
 ====================

 [1]  Proftpd. 2015. Proftpd Bug Report , MOD_SFTP Bug Report.
 [ONLINE] Available at:
http://bugs.proftpd.org/show_bug.cgi?id=4210. [Accessed 29 November 2015].


 [2] Lemonias, N. (2015). SecurityFocus - Proftpd Heap Overflow.
 [ONLINE] Securityfocus.com.  Available at:
http://www.securityfocus.com/archive/1/536953/30/0/threaded
 [Accessed 29 November 2015].


 [3] Cnvd.org.cn, (2015). China's Emergency Response Team - CERT.
 [online] Available at:
http://www.cnvd.org.cn/flaw/show/CNVD-2015-07798 [Accessed 29 November 2015].
 2015].

Powered by blists - more mailing lists