Bugtraq mailing list archives
Re: ProFTPD mod_tls pre-authentication buffer overflow
From: Mark Wadham <mark.wadham () areti net>
Date: Wed, 29 Nov 2006 10:39:23 +0000
HiCan i get this straight, vendor was notified on the 16th of November, but this vulnerability has been part of VulnDisco since Jan 2006? Is that actually correct? This was known about ten months ago but not disclosed until now?
Mark research () gleg net wrote:
Name: ProFTPD mod_tls pre-authentication buffer overflow Vendor: http://www.proftpd.org Release date: 28 Nov, 2006 Author: Evgeny Legerov <research () gleg net> I. DESCRIPTION A remote buffer overflow vulnerability has been found in mod_tls module of ProFTPD server. The vulnerability could allow a remote un-authenticated attacker to gain root privileges. II. DETAILS Let's have a look at the code (ProFTPD version 1.3.0): contrib/mod_tls.c: """ static char *tls_x509_name_oneline(X509_NAME *x509_name) { static char buf[256] = {'\0'}; /* If we are using OpenSSL 0.9.6 or newer, we want to use * X509_NAME_print_ex() * instead of X509_NAME_oneline(). */ #if OPENSSL_VERSION_NUMBER < 0x000906000L memset(&buf, '\0', sizeof(buf)); return X509_NAME_oneline(x509_name, buf, sizeof(buf)); #else /* Sigh...do it the hard way. */ BIO *mem = BIO_new(BIO_s_mem()); char *data = NULL; long datalen = 0; int ok; if ((ok = X509_NAME_print_ex(mem, x509_name, 0, XN_FLAG_ONELINE))) [1] datalen = BIO_get_mem_data(mem, &data); if (data) { memset(&buf, '\0', sizeof(buf)); [2] memcpy(buf, data, datalen); buf[datalen] = '\0'; buf[sizeof(buf)-1] = '\0'; BIO_free(mem); return buf; } BIO_free(mem); return NULL; #endif /* OPENSSL_VERSION_NUMBER >= 0x000906000 */ } """ The value of 'datalen' parameter is fully controlled by us (see [1]). On line [2] we will be able to overflow the 'buf' buffer with our data. III. VENDOR RESPONSE Vendor has been notified on Nov 16, 2006 but ProFTPD 1.3.0a is still vulnerable. IV. CREDIT Discovered by Evgeny Legerov. The vulnerability is a part of VulnDisco Pack Professional since Jan, 2006.
-- Mark Wadham e: mark.wadham () areti net t: +44 (0)20 8315 5800 f: +44 (0)20 8315 5801Areti Internet Ltd., http://www.areti.net/
=================================================================== Areti Internet Ltd: BS EN ISO 9001:2000 Providing corporate Internet solutions for more than 10 years. ===================================================================
Current thread:
- ProFTPD mod_tls pre-authentication buffer overflow research (Nov 28)
- Re: ProFTPD mod_tls pre-authentication buffer overflow Mark Wadham (Nov 29)