|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Seti
home information leakage and remote compromise
From: Berend-Jan Wever (SkyLinedEDUP.TUDELFT.NL)
Date: Sun Apr 06 2003 - 05:10:08 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Information leakage and remotely __________________________________
exploitable buffer overflow in various SETIhome ..cc.
setihome clients and the main server. ..--''' $$$$
,CCcc, .-' "":
Januari 15, 2002 by Berend-Jan Wever $$$CCCCCCb ; :
_______________________________ $$$$bbCCCCCCc; '.
(_____ | Y$$$$$$bCCCCCCc :
_____________)|<\/ Y$$$$$$$$$bCCCCc:
Lined/ "$$$$$$$$$$$bCCc
The homepage for absolutly nothing! "Y$$$$$$$$$$$"
``"**""'`
http://spoor12.edup.tudelft.nl http://setiathome.berkeley.edu
Confirmed information leaking:
This issue affects all clients.
Confirmed remote exploitable:
setiathome-3.03.i386-pc-linux-gnu-gnulibc2.1
setiathome-3.03.i686-pc-linux-gnu-gnulibc2.1
setiathome-3.03.i386-pc-linux-gnulibc1-static
setiathome-3.03.i686-pc-linux-gnulibc1-static
setiathome-3.03.i386-winnt-cmdline.exe
i386-unknown-freebsd2.2.8 (Special thanks to Niels Heinen)
SETIhome.exe (v3.07 Screensaver)
Confirmed DoS-able using buffer overflow:
The main setihome server at shserver2.ssl.berkeley.edu
Presumed vulnerable to buffer overflow:
All other clients.
BACKGROUND INFORMATION-----------------------------------------------------
From "http://setiathome.berkeley.edu/" :
"SETIhome is a scientific experiment that uses Internet-connected
computers in the Search for Extraterrestrial Intelligence (SETI). You
can participate by running a free program that downloads and analyzes
radio telescope data. "
"The SETIhome program is a special kind of screensaver. Like other
screensavers it starts up when you leave your computer unattended, and
it shuts down as soon as you return to work. What it does in the interim
is unique. While you are getting coffee, or having lunch or sleeping,
your computer will be helping the Search for Extraterrestrial
Intelligence by analyzing data specially captured by the world's largest
radio telescope. "
"The client/screensaver is available for download only from this web page
- we do not support SETIhome software obtained elsewhere. This software
will upload and download data only from our data server here at Berkeley.
The data server doesn't download any executable code to your computer.
All in all, the screensaver is much safer than the browser you're running
right now!"
There are currently over four million registered users of setihome. Over
half a million of these users are "active"; they have returned at least one
result within the last four weeks.
THE VULNERABILITIES--------------------------------------------------------
The setihome clients use the HTTP protocol to download new workunits, user
information and to register new users. The implementation leaves two
security vulnerabilities:
1) All information is send in plaintext across the network. This
information includes the processor type and the operating system of the
machine setihome is running on.
2) There is a bufferoverflow in the server responds handler. Sending an
overly large string followed by a newline ('\n') character to the client
will trigger this overflow. This has been tested with various versions of
the client. All versions are presumed to have this flaw in some form.
3) A similar buffer overflow seems to affect the main setihome server at
shserver2.ssl.berkeley.edu. It closes the connection after receiving a
too large string of bytes followed by a '\n'.
THE TECHNIQUE--------------------------------------------------------------
1) Sniffing the information exposed by the setihome client is trivial and
very usefull to a malicious person planning an attack on a network. A
passive scan of machines on a network can be made using any packetsniffer
to grab the information from the network.
2) All tested clients have similar buffer overflows, which allowed
setting eip to an arbitrairy value which can lead to arbitrairy code
execution. An attacker would have to reroute the connection the client
tries to make to the setihome webserver to a machine he or she controls.
This can be done using various widely available spoofing tools. Setihome
also has the ability to use a HTTP-proxy, an attacker could also use the
machine the PROXY runs on as a base for this attack. Routers can also be
used as a base for this attack.
3) Exploitation of the bug in the server has offcourse not been tested.
Do understand that successfull exploitation of the bug in the server would
offer a platform from which ALL setihome clients can be exploited.
THE EXPLOITS---------------------------------------------------------------
Attached to this mail you will find a sample exploit running on linux that
will supply a remote shell to an attacker for various linux clients. It
will crash the *BSD client, the windows commandline client and windows
screensaver.
TIMELINE-------------------------------------------------------------------
2002/12/05 Information leakage discovered.
2002/12/14 Bufferoverflow in client discovered.
2002/12/31 Setihome team contacted through their website
http://setiathome.berkeley.edu/help.html.
2003/01/07 Setihome team contacted again.
2003/01/14 Bufferoverflow in server discovered.
2003/01/21 Setihome team contacted again, this time through email.
2003/01/21 Setihome team confirmed the problem.
2003/01/25 Setihome team promissed fixed version are being build.
2003/02/03 Setihome team informed me about problems with the fixes for the
win32 version.
In more then three months, the setihome has been unable to produce a
patched version of the clients.
THANKS---------------------------------------------------------------------
Special thanks go out to:
- Aleph1 for "Smashing the Stack for Fun and Profit".
- Niels Heinen for his work on exploiting setihome on FreeBSD.
- Blazde and the other 0dd folks for help with the win32 shellcode.
UNRELATED REQUEST----------------------------------------------------------
I'd like to take this opportunity to inform everybody who's interested that
I am looking for a place to do an internship from august 2003 untill
januari 2004. I am looking for a company where I can do some security
related programming. I am a 26 year old student of Infomation Technology at
the TH Rijswijk in the Netherlands. I have experience with various
programming and scripting languages, operating systems and protocols. If you
know of a company who would be interested or if you need more details like
my C.V., please contact me through email at the address below.
Best regards,
Berend-Jan Wever
SkyLinededup.tudelft.nl
http://Spoor12.EduP.TUDelft.nl
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by Prometric - More than testing, learning.
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
http://www.prometric.com
Prometric, part of The Thomson Corporation, is the leader in
technology-enabled testing and assessment services for information
technology certification, academic admissions, professional licensure and
certifications, computer-based driver's licensing, and corporate testing.
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]