[NEWS] Opensawn XAUTH/PAM Buffer Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 01/26/05

  • Next message: SecuriTeam: "[NEWS] Multiple Crafted IPv6 Packets Cause Reload" 
    To: list@securiteam.com
Date: 26 Jan 2005 19:11:17 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Opensawn XAUTH/PAM Buffer Overflow
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.openswan.org/> Openswan is "an implementation of IPsec for
    Linux. It supports kernels 2.0, 2.2, 2.4 and 2.6, and runs on many
    different platforms, including x86, x86_64, ia64, MIPS and ARM".

    Remote exploitation of a stack based buffer overflow vulnerability in
    Xelerance Corp.'s Openswan could allow attackers to execute arbitrary
    code.

    DETAILS

    Vulnerable Systems:
     * Openswan verison 2.2.0 and prior

    Immune Systems:
     * Openswan version 1.0.9 or newer
     * Openswan version 2.3.0 or newer

    The vulnerability specifically exists due to a lack of bounds checking in
    the pluto application when Openswan is compiled with XAUTH and PAM
    support. The get_internal_addresses() function in programs/pluto/xauth.c
    allocates a small character array and copies an overly long user
    controlled buffer into the array as seen below. The resulting stack
    overflow may be leveraged to execute arbitrary code with permissions of
    the pluto process.

    in programs/pluto/id.h:

    47: #define IDTOA_BUF 512

    in programs/pluto/xauth.c:

    148: #ifdef XAUTH_USEPAM
    149: int retval;
    150: char str[48];
    151: #endif
    ..
    169: if(retval == PAM_SUCCESS)
    170: {
    171: char buf[IDTOA_BUF];
    ..
    185: sprintf(str,"ID=%s", buf);

    Analysis:
    Successful exploitation of the vulnerability can allow remote attackers to
    execute code with privileges of the pluto process. Exploitation in the
    wild will be limited due to the fact that Openswan would need to be
    compiled with XAUTH and PAM options enabled which are both disabled by
    default. In addition, exploitation occurs after an IKE Phase-1 Security
    Association (SA) has been established which requires authentication of a
    shared key and the supplied client certificate, further reducing the
    impact of this vulnerability.

    Workaround:
    The XAUTH and PAM configuration options can be found in Makefile.inc in
    the Openswan source tree. Disable both configuration options or apply the
    following vendor-supplied patch:

    Index: xauth.c
     ===================================================================
    RCS file: /xelerance/master/openswan-2/programs/pluto/xauth.c,v
    retrieving revision 1.35
    diff -u -p -u -r1.35 xauth.c
    - --- xauth.c 30 Nov 2004 15:30:24 -0000 1.35
    +++ xauth.c 8 Jan 2005 02:25:35 -0000
    @@ -187,7 +187,7 @@ int get_internal_addresses(struct connec {
     #ifdef XAUTH_USEPAM
         int retval;
    - - char str[48];
    + char str[IDTOA_BUF+sizeof("ID=")+2];
     #endif

     #ifdef NAT_TRAVERSAL /* only NAT-T code lets us do virtual ends */
    @@ -222,7 +222,7 @@ int get_internal_addresses(struct connec
                                                memmove(buf, c1+3,
    strlen(c1) + 1 - 3);
                                        }
                                }
    - - sprintf(str,"ID=%s", buf);
    + snprintf(str, sizeof(str), "ID=%s", buf);
                                pam_putenv(con->pamh,str);
                                pam_open_session(con->pamh,0);
                        }

    Vendor Status:
    The vendor has addressed this vulnerability in newly released Openswan
    packages. Users should upgrade to Openswan 1.0.9 or Openswan 2.3.0
    depending on their current configuration. New packages are available from
    the following link: <http://www.openswan.org/code/>
    http://www.openswan.org/code/

    Disclosure Timeline:
    01/06/2005 - Initial vendor notification
    01/06/2005 - Initial vendor response
    01/26/2005 - Public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> iDEFENSE.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=190&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=190&type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Multiple Crafted IPv6 Packets Cause Reload"

    Relevant Pages