The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Opensawn XAUTH/PAM Buffer Overflow
------------------------------------------------------------------------
SUMMARY
<http://www.openswan.org/> Openswan is "an implementation of IPsec for
Linux. It supports kernels 2.0, 2.2, 2.4 and 2.6, and runs on many
different platforms, including x86, x86_64, ia64, MIPS and ARM".
Remote exploitation of a stack based buffer overflow vulnerability in
Xelerance Corp.'s Openswan could allow attackers to execute arbitrary
code.
DETAILS
Vulnerable Systems:
* Openswan verison 2.2.0 and prior
Immune Systems:
* Openswan version 1.0.9 or newer
* Openswan version 2.3.0 or newer
The vulnerability specifically exists due to a lack of bounds checking in
the pluto application when Openswan is compiled with XAUTH and PAM
support. The get_internal_addresses() function in programs/pluto/xauth.c
allocates a small character array and copies an overly long user
controlled buffer into the array as seen below. The resulting stack
overflow may be leveraged to execute arbitrary code with permissions of
the pluto process.
in programs/pluto/id.h:
47: #define IDTOA_BUF 512
in programs/pluto/xauth.c:
148: #ifdef XAUTH_USEPAM
149: int retval;
150: char str[48];
151: #endif
..
169: if(retval == PAM_SUCCESS)
170: {
171: char buf[IDTOA_BUF];
..
185: sprintf(str,"ID=%s", buf);
Analysis:
Successful exploitation of the vulnerability can allow remote attackers to
execute code with privileges of the pluto process. Exploitation in the
wild will be limited due to the fact that Openswan would need to be
compiled with XAUTH and PAM options enabled which are both disabled by
default. In addition, exploitation occurs after an IKE Phase-1 Security
Association (SA) has been established which requires authentication of a
shared key and the supplied client certificate, further reducing the
impact of this vulnerability.
Workaround:
The XAUTH and PAM configuration options can be found in Makefile.inc in
the Openswan source tree. Disable both configuration options or apply the
following vendor-supplied patch:
Index: xauth.c
===================================================================
RCS file: /xelerance/master/openswan-2/programs/pluto/xauth.c,v
retrieving revision 1.35
diff -u -p -u -r1.35 xauth.c
- --- xauth.c 30 Nov 2004 15:30:24 -0000 1.35
+++ xauth.c 8 Jan 2005 02:25:35 -0000
@@ -187,7 +187,7 @@ int get_internal_addresses(struct connec {
#ifdef XAUTH_USEPAM
int retval;
- - char str[48];
+ char str[IDTOA_BUF+sizeof("ID=")+2];
#endif
#ifdef NAT_TRAVERSAL /* only NAT-T code lets us do virtual ends */
@@ -222,7 +222,7 @@ int get_internal_addresses(struct connec
memmove(buf, c1+3,
strlen(c1) + 1 - 3);
}
}
- - sprintf(str,"ID=%s", buf);
+ snprintf(str, sizeof(str), "ID=%s", buf);
pam_putenv(con->pamh,str);
pam_open_session(con->pamh,0);
}
Vendor Status:
The vendor has addressed this vulnerability in newly released Openswan
packages. Users should upgrade to Openswan 1.0.9 or Openswan 2.3.0
depending on their current configuration. New packages are available from
the following link: <http://www.openswan.org/code/>
http://www.openswan.org/code/
Disclosure Timeline:
01/06/2005 - Initial vendor notification
01/06/2005 - Initial vendor response
01/26/2005 - Public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDEFENSE.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=190&type=vulnerabilities>
http://www.idefense.com/application/poi/display?id=190&type=vulnerabilities
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
