Multiple Vendor INN remote Vulnerability
BID:687
Info
Multiple Vendor INN remote Vulnerability
| Bugtraq ID: | 687 |
| Class: | Input Validation Error |
| CVE: |
CVE-1999-0043 CVE-1999-0868 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Dec 04 1996 12:00AM |
| Updated: | Mar 19 2015 09:45AM |
| Credit: | This vulnerability was reported to bugtraq by Matt Power <[email protected]> on 4 December 1996. |
| Vulnerable: |
RedHat Linux 4.1 RedHat Linux 4.0 Netscape News Server 1.1 NEC Goah/NetworkSV R3.1 NEC Goah/NetworkSV R2.2 NEC Goah/NetworkSV R1.2 NEC Goah/IntraSV R1.1 ISC INN 1.5 ISC INN 1.4 unoff4 ISC INN 1.4 unoff3 ISC INN 1.4 sec2 ISC INN 1.4 sec Caldera OpenLinux Base 1.0 BSDI BSD/OS 2.1 |
| Not Vulnerable: |
ISC INN 1.5.1 |
Discussion
Multiple Vendor INN remote Vulnerability
There are two problems with INN that both result in remote compromise of the news server. Both problems were decribed in CERT advisory CA-97.08. The description below was taken from it.
Topic 1 - Information provided with the initial advisory
---------------------------------------------------------
The INN daemon (innd) processes "newgroup" and "rmgroup" control messages in a shell script (parsecontrol) that uses the shell's "eval" command. However, some of the information passed to eval comes from the message without adequate checks for characters that are special to the shell.
This permits anyone who can send messages to an INN server - almost anyone with Usenet access - to execute arbitrary commands on that server. These commands run with the uid and privileges of the "innd" process on that server. Because such messages are usually passed through Internet firewalls to a site's news server, servers behind such firewalls are vulnerable to attack. Also, the program executes these commands before checking whether the sender is authorized to create or remove newsgroups, so checks at that level (such as running pgpverify) do not prevent this problem.
Topic 2 - ucbmail
-----------------
INN itself attempts to carefully remove certain shell "metacharacters" from data in control messages before passing that data to a shell. The patch for Topic 1 fixes some of the checks that were found to be inadequate. However ucbmail, a program typically configured as the mailer INN should use, lacks similar checks. INN passes some data unchecked to this mailer, which in turn passes the data to a shell for processing.
There are two problems with INN that both result in remote compromise of the news server. Both problems were decribed in CERT advisory CA-97.08. The description below was taken from it.
Topic 1 - Information provided with the initial advisory
---------------------------------------------------------
The INN daemon (innd) processes "newgroup" and "rmgroup" control messages in a shell script (parsecontrol) that uses the shell's "eval" command. However, some of the information passed to eval comes from the message without adequate checks for characters that are special to the shell.
This permits anyone who can send messages to an INN server - almost anyone with Usenet access - to execute arbitrary commands on that server. These commands run with the uid and privileges of the "innd" process on that server. Because such messages are usually passed through Internet firewalls to a site's news server, servers behind such firewalls are vulnerable to attack. Also, the program executes these commands before checking whether the sender is authorized to create or remove newsgroups, so checks at that level (such as running pgpverify) do not prevent this problem.
Topic 2 - ucbmail
-----------------
INN itself attempts to carefully remove certain shell "metacharacters" from data in control messages before passing that data to a shell. The patch for Topic 1 fixes some of the checks that were found to be inadequate. However ucbmail, a program typically configured as the mailer INN should use, lacks similar checks. INN passes some data unchecked to this mailer, which in turn passes the data to a shell for processing.
Exploit / POC
Multiple Vendor INN remote Vulnerability
x
x
Solution / Fix
Multiple Vendor INN remote Vulnerability
Solution:
For a solution you can either upgrade to INN 1.5.1 or install vendor supplied patches.
Solution:
For a solution you can either upgrade to INN 1.5.1 or install vendor supplied patches.
References
Multiple Vendor INN remote Vulnerability
References:
References: