[UNIX] 13 Remote Ethereal Buffer Overflows (BGP, EIGRP, IGAP, IRDA, ISUP, NetFlow, PGM, TCAP and UCP)
From: SecuriTeam (support_at_securiteam.com)
Date: 03/24/04
- Previous message: SecuriTeam: "[UNIX] OpenBSD isakmpd Payload Handling DoS"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 24 Mar 2004 12:15:57 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
13 Remote Ethereal Buffer Overflows (BGP, EIGRP, IGAP, IRDA, ISUP,
NetFlow, PGM, TCAP and UCP)
------------------------------------------------------------------------
SUMMARY
" <http://www.ethereal.com> Ethereal is used by network professionals
around the world for troubleshooting, analysis, software and protocol
development, and education. It has all of the standard features you would
expect in a protocol analyzer, and several features not seen in any other
product. Its open source license allows talented experts in the networking
community to add enhancements. It runs on all popular computing platforms,
including Unix, Linux, and Windows."
During a code audit of Ethereal thirteen remotely triggerable stack-
overflows where discovered. The vulnerable dissectors in question are
namely: BGP, EIGRP, IGAP, IRDA, ISUP, NetFlow, PGM, TCAP and UCP.
With the exception of 3 all discovered overflows allow arbitrary code
execution by injecting carefully crafted packets to the sniffed wire or by
convincing someone to load a malicious packet capture file into Ethereal.
DETAILS
Vulnerable Systems:
* Ethereal 0.8.14 - 0.10.2
In the beginning of March a code audit of Ethereal revealed remotely
triggerable overflows within a few of the over 400 dissectors. During the
process of working with the Ethereal vendor the audit continued and until
today it was possible to identify a total count of 13 possible stack
overflows within 9 different dissectors.
For the purpose of clarity it was chosen to describe all these bugs within
this advisory instead of spreading the information over nine single
advisories.
Because the defects affect different parts of the code base and were
introduced at different dates within the last 3 years the following table
gives a short overview of the exact CVS commit timestamps and the version
number it first appeared in.
(Version 0.8.14)
[04] EIGRP Dissector TLV_IP_INT Long IP Address Overflow
- Revision: 1.7, Thu Nov 9 05:16:19 2000 UTC
[05] EIGRP Dissector TLV_IP_EXT Long IP Address Overflow
- Revision: 1.7, Thu Nov 9 05:16:19 2000 UTC
(version 0.8.19)
[06] PGM Dissector NakList Overflow
- Revision: 1.1, Thu Jul 12 20:16:28 2001 UTC
(version 0.9.0)
[11] UCP Dissector Handle String-Field Overflow
- Revision: 1.1, Mon Oct 8 17:30:23 2001 UTC
[12] UCP Dissector Handle Int-Field Overflow
- Revision: 1.1, Mon Oct 8 17:30:23 2001 UTC
[13] UCP Dissector Handle Time-Field Overflow
- Revision: 1.1, Mon Oct 8 17:30:23 2001 UTC
(version 0.9.10)
[01] Netflow v9 Dissector Template Caching Overflow
- Revision 1.9 Tue Mar 4 03:37:12 2003 UTC
(version 0.9.16)
[09] ISUP Dissector INTERWORKING FUNCTION ADDRESS Overflow
- Revision: 1.29, Fri Oct 3 20:58:13 2003 UTC
[10] TCAP Dissector TID Overflow
- Revision: 1.1, Thu Oct 2 06:13:28 2003 UTC
(version 0.10.0)
[02] IGAP Dissector Account Overflow
- Revision 1.1 Wed Dec 10 19:21:55 2003 UTC
[03] IGAP Dissector Message Overflow
- Revision 1.1 Wed Dec 10 19:21:55 2003 UTC
(version 0.10.1)
[08] BGP Dissector MPLS Label Overflow
- Revision: 1.84, Tue Jan 6 02:29:36 2004 UTC
[07] IRDA Dissector Plugin IRCOM_PORT_NAME Overflow
- Revision: 1.1, Thu Dec 18 19:07:12 2003 UTC
In the following paragraphs all 13 bugs are described in a short form. The
referenced URL within the header of this advisory will be updated with
more detailed information (incl. snippets) when the Ethereal developers
have released 0.10.3.
[01] NetFlow v9 Dissector Template Caching Overflow
When parsing the v9_template structure within a NetFlow UDP packet a
template_entry count > 64 will overflow a stackbuffer and allows
overwriting the saved instruction pointer, thus allowing remote code
execution.
[02] IGAP Protocol Dissector Account Overflow
[03] IGAP Protocol Dissector Message Overflow
When parsing an IGAP protocol packet that contains either an overlong
accountname (>17) or an overlong message (>65) different buffers may
overflow the stack, allowing an over- write of up to 238 (or 190) bytes.
In both cases remote code execution exploitation is possible.
[04] EIGRP Protocol TLV_IP_INT Long IP Address Overflow
When parsing an EIGRP IP packet that contains an overlong IP address this
will overflow a stack buffer and therefore can lead to remote code
execution
[05] EIGRP Protocol TLV_IP_EXT Long IP Address Overflow
When parsing an EIGRP Extended IP packet that contains an
overlong-extended IP address this will overflow a stack buffer and can
lead to remote code execution
[06] PGM Protocol NakList Overflow
When parsing a PGM packet with a carefully crafted NakList a possible
integer underflow can result in a very small stack- overflow. Due to the
stacklayout code execution exploitation seems very unlikely.
[07] IRDA Protocol Plugin IRCOM_PORT_NAME Overflow
When parsing an IRCOM_PORT_NAME packed an overlong portname can overwrite
up to 2 bytes on the stack. Similar to [06] the stacklayout seems to make
remote code execution very difficult or impossible.
[08] BGP Protocol MPLS Label Overflow
When parsing a BGP Packet with a MPLS IPv6 label up to 13 bytes on the
stack may be overwritten with arbitrary data. Due to the stacklayout
exploitability seems unlikly and was therefore not tested.
[09] ISUP Protocol INTERWORKING FUNCTION ADDRESS Overflow
When parsing an ISUP Packet an oversized IWFA will overflow a stack buffer
and can lead to remote code execution
[10] TCAP Protocol TID Overflow
When handling the ASN.1 encoded Transaction ID within a TCAP packet a 4
byte stack variable may overflow and can lead to remote code execution
[11] UCP Protocol Handle String-Field Overflow
When handling a string within an UCP packet a stack buffer of BUFSIZ bytes
may overflow and can therefore lead to remote code execution.
To exploit this vulnerability over the wire an attacker must be able to
fit more than BUFSIZ bytes into one TCP packet. This means it is only
exploitable on the wire if the system has a MTU bigger than BUFSIZ. BUFSIZ
is 8192 on glibc systems, 1024 on BSD systems and 512 on Windows systems.
[12] UCP Protocol Handle Int-Field Overflow
When handling an Integer field within an UCP packet a stack buffer of
BUFSIZ bytes may overflow and can therefore lead to remote code execution.
To exploit this vulnerability over the wire an attacker must be able to
fit more than BUFSIZ bytes into one TCP packet. This means it is only
exploitable on the wire if the system has a MTU bigger than BUFSIZ. BUFSIZ
is 8192 on glibc systems, 1024 on BSD systems and 512 on Windows systems.
[13] UCP Protocol Handle Time-Field Overflow
When handling a Time field within an UCP packet a stack buffer of BUFSIZ
bytes may overflow and can therefore lead to remote code execution.
To exploit this vulnerability over the wire an attacker must be able to
fit more than BUFSIZ bytes into one TCP packet. This means it is only
exploitable on the wire if the system has a MTU bigger than BUFSIZ. BUFSIZ
is 8192 on glibc systems, 1024 on BSD systems and 512 on Windows systems.
Disclosure Timeline:
5 March 2004 - Ethereal developers were contacted by email telling them
about 10(of the 13) holes. 6 holes were closed the same day EIGRP, IGAP,
ISUP and BGP.
7 March 2004 - IRDA hole closed (after checking specs)
8 March 2004 - PGM hole closed (after checking specs)
9 March 2004 - NetFlow hole closed (after checking specs)
17 March 2004 - UCP holes were discovered and mailed to vendor
19 March 2004 - UCP and TCAP holes closed (after checking specs)
22 March 2004 - Ethereal developers have releases a mini advisory urging
their users to upgrade to version 0.10.3 that will be released later this
week
23 March 2004 - Public Disclosure
CVE Information:
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0176 to this issue.
Recommendation:
Until you can upgrade to version 0.10.3 of Ethereal or to the bugfixed
package from your distributor it is strongly recommended to disable the
following dissectors in the menu:
Analyze->Enabled Protocols
disable: BGP, EIGRP, IGAP, IRDA, ISUP, NetFlow, PGM, TCAP, UCP
ADDITIONAL INFORMATION
The information has been provided by <mailto:s.esser@ematters.de> Stefan
Esser.
The original article can be found at:
<http://security.e-matters.de/advisories/032004.html>
http://security.e-matters.de/advisories/032004.html
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[UNIX] OpenBSD isakmpd Payload Handling DoS"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
