========================================
        INetCop Security Advisory #2002-0x82-009
        ========================================

* Title: Remote multiple vulnerability in apt-www-proxy.

0x01. Description

__
bash$ lynx -dump http://ironsides.terrabox.com/~ahzz/apt-www-proxy/

                               apt-www-proxy

   apt-www-proxy is a proxy server designed specificly for apt-get
   http:// repositories. It gathers files that clients request, and then
   simultaneously retrieves, streams to client, and to local disk archive
   based on a set of archive mappings a lot like apt-proxy does. I
   decided to write this due to the unstable nature of apt-proxy. IMHO
   this is due to it being written in shell script. It's a good design,
   just was never implemented in the right kind of language.

   [1]apt-www-proxy 0.1 - accepts clients and automaticly says "not
   found". nifty eh? 8-P

   And of course, who would be without the [2]latest snapshot!

   Back to my [3]homepage!

References

   1. http://ironsides.terrabox.com/~ahzz/apt-www-proxy/apt-www-proxy-0.1.tar.gz
   2. http://ironsides.terrabox.com/~ahzz/apt-www-proxy/latest-AWP.tar.bz2
   3. http://ironsides.terrabox.com/~ahzz/index.html
bash$

--
OK, Let's analyze.
Examine syslog() function first.
There is awp_log() function to 173 lines of 'src/utils.c' code.
    __
   173  void awp_log(int level, const char *message)
        ...
   222    if((level < LOG_DEBUG) || (1 ==  logit))
   224        /* log that information */
   227            syslog(level, message); // Here.
        ...
    --
It's very bad state.
awp_log() function is used as follows.
Format string bug happens by setting file error log.
Let's find awp_log() function in 'apt-www-proxy.c' code.
    __
    47    awp_log(LOG_DATA, errlog);
    78    awp_log(LOG_DATA, errlog);
    93    awp_log(LOG_DATA, errlog);
   130                awp_log(LOG_DATA, errlog);
   146                awp_log(LOG_DATA, errlog);
   157            awp_log(LOG_GEN, errlog);
   287    awp_log(LOG_NOTICE, errlog);
   500        awp_log(LOG_NOTICE,errlog);
   510        awp_log(LOG_CRIT, errlog);
   527            awp_log(LOG_ERR, errlog);
   538    awp_log(LOG_INFO, errlog);
   546        awp_log(LOG_NOTICE, errlog);
   554        awp_log(LOG_NOTICE, errlog);
   560        awp_log(LOG_NOTICE, errlog);
   572        awp_log(LOG_NOTICE, errlog);
    --
Second, examine remote DoS vulnerability.
We read 'utils.c' code again.
    __
   260  int parse_get(struct client * client)
        ...
   268    /* now match against the archives */
   269    if(!strncmp("http://", client->get, 7)) // Here.
   270      {
   271        /* AHHA! It's a full URL. */
    --
If 'client->get' value is NULL, strncmp() function segfault happens crash.
Program function execution structure is as following.
----------------------------------------------------------------------
main()->main_loop()->process_cli()->parse_get()->strncmp()->'segfault'
----------------------------------------------------------------------
0x02. Vulnerable Packages
Vendor site: http://ironsides.terrabox.com/~ahzz/apt-www-proxy/
apt-www-proxy 0.1
-apt-www-proxy-0.1.tar.gz
+Linux
0x03. Exploit
Try simple test.
* Test -
First, execute apt-www-proxy daemon.
Do debug in other shell thereafter.
#1) Test attacker:
bash$ (printf "\r\n";cat)|nc 0 6543
#2) Debugging:
Program received signal SIGSEGV, Segmentation fault.
strncmp (s1=0x804b730 "http://", s2=0x0, n=7)
    at ../sysdeps/generic/strncmp.c:43
43      ../sysdeps/generic/strncmp.c: No such file or directory.
(gdb) bt
#0  strncmp (s1=0x804b730 "http://", s2=0x0, n=7)
    at ../sysdeps/generic/strncmp.c:43
#1  0x804a9f3 in parse_get (client=0x80516c8) at utils.c:269
#2  0x804a176 in process_cli (reads={__fds_bits = {64, 0 <repeats 31 times>}},
    writes={__fds_bits = {64, 0 <repeats 31 times>}}) at lists.c:270
#3  0x8049750 in main_loop (s=5) at apt-www-proxy.c:408
#4  0x8049b56 in main (argc=3, argv=0xbffffbe4,
    arge=0xbffffbf4 ...) at apt-www-proxy.c:578
(gdb)
You can kill daemon through this.
Do you want exploit code? Very regrettable. :-(
We don't want to compose DoS code.
0x04. Patch
=== utils.patch ===
--- utils.c	Mon Oct 22 15:20:29 2001
+++ utils.patch.c	Sat Nov 30 02:26:35 2002
 -224,11 +224,11 
       /* log that information */
       if(background)
 	{
-	  syslog(level, message);
+	  syslog(level, "%s", message);
 	}
       else
 	{
-	  fprintf(stderr, message);
+	  fprintf(stderr, "%s", message);
 	}
     }
 }
 -265,6 +265,10 
   struct urlmask *curu = urls;
   int found = 0;
 
+  if(client->get==NULL)
+  {
+      return(0);
+  }
   /* now match against the archives */
   if(!strncmp("http://", client->get, 7))
     {
=== eof ===
P.S: Sorry, for my poor english.
--
By "dong-houn yoU" (Xpl017Elz), in INetCop(c) Security.
MSN & E-mail: szoahc(at)hotmail(dot)com,
              xploit(at)hackermail(dot)com
INetCop Security Home: http://www.inetcop.org (Korean hacking game)
             My World: http://x82.i21c.net
GPG public key: http://wizard.underattack.co.kr/~x82/h0me/pr0file/x82.k3y
--
-- 
_______________________________________________
Get your free email from http://www.hackermail.com
Powered by Outblaze

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]