PFinger Format String vulnerability
December 16th, 2002NGSSoftware Insight Security Research Advisory
Name: PFinger Format String vulnerability
Systems: PFinger version 0.7.8 and earlier
Severity: High Risk
Vendor URL: http://www.xelia.ch/unix/pfinger/
Author: David Litchfield (david@ngssoftware.com)
Advisory URL: http://www.ngssoftware.com/advisories/pfinger.txt
Date: 16th December 2002
Advisory number: #NISR16122002B
Description
***********
PFinger is an open-source replacement of the GNU Finger daemon. PFinger suffers from a format string vulnerability that, when exploited, can allow the remote execution of arbitrary code.
Details
*******
The format string vulnerability arises due to an unsafe call to syslog() in the log() function of log.c
..
syslog(level, syslog_mem);
..
To make this safe a format string should be specified:
..
syslog(level,”%s”, syslog_mem);
..
Due to the way requests are logged the only way to exploit this vulnerability is through setting the DNS name of the fingering host to the attacker supplied format string.
h_ent = gethostbyaddr((char *)&remaddr.sin_addr, sizeof(remaddr.sin_addr), AF_INET);
if (h_ent)
conn.hostname = strdup(h_ent->h_name);
else
conn.hostname = “(remote)”;
log(LOG_INFO, “Connection from %s (%s)”,conn.hostname,inet_ntoa(remaddr.sin_addr));
This code looks up the Domain name of the fingering host and logs the connection information. This appears to be the only place where user controlled data is logged. For exploitation to succeed the attacker must either control their own DNS, the DNS server of the target host or alternatively spoof the DNS reply. This makes exploitation more difficult but by no means impossible.
Fix Information
***************
NGSSoftware alerted the author of PFinger with this problem on the 27th of November, 2002. The author has responded and assured NGS that a fix will be implemented shortly. Those who are comfortable with C and cc/gcc can fix this themselves by editing log.c in the manner described in the “Details” section above.
A check for this issue has been added to Typhon III, NGSSoftware’s advanced vulnerability assessment tool, of which, more information is available at the NGSSite: http://www.ngssoftware.com/
For more information about format string vulnerabilities please read
http://www.nextgenss.com/papers/win32format.doc
http://julianor.tripod.com/usfs.html
About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application security assessment scanners. Based in the United Kingdom, NGSSoftware have offices in the South of London and the East Coast of Scotland. NGSSoftware’s sister company NGSConsulting, offers best of breed security consulting services, specialising in application, host and network security assessments.
http://www.ngssoftware.com/
http://www.ngsconsulting.com/
Telephone +44 208 401 0070
Fax +44 208 401 0076
enquiries@ngssoftware.com
