C.J. Steele Tattle Remote Command Execution Vulnerability

Bugtraq ID:	13883
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 07 2005 12:00AM
Updated:	Jun 07 2005 12:00AM
Credit:	Discovery is credited to "b0iler" <[email protected]>.
Vulnerable:	C.J. Steele tattle
Not Vulnerable:

C.J. Steele Tattle Remote Command Execution Vulnerability

tattle is affected by a remote command execution vulnerability.

An attacker can supply arbitrary commands prefixed with the '|' character as a value for the 'tld' variable that will be executed in the context of the application.

An attacker can exploit this issue in various ways including providing a malformed user name through FTP.

C.J. Steele Tattle Remote Command Execution Vulnerability

An exploit is not required.

The following proof of concept is available:
sshd rhost 9 10 11 |rm${IFS}-rf${IFS}/|echo'1.1.1.1'

C.J. Steele Tattle Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

C.J. Steele Tattle Remote Command Execution Vulnerability

References:

• `tattle` -- automatic reporting of SSH brute-force attacks ("C.J. Steele, CISSP" )
  
• remote command execution in 'tattle' ("b0iler" )