Core Security Technologies Advisory 2010.0104

2010-02-06T00:00:00
ID PACKETSTORM:85997
Type packetstorm
Reporter Core Security Technologies
Modified 2010-02-06T00:00:00

Description

                                        
                                            `-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
Core Security Technologies - CoreLabs Advisory  
http://www.coresecurity.com/corelabs/  
  
LANDesk command injection  
  
  
1. *Advisory Information*  
  
Title: LANDesk command injection  
Advisory Id: CORE-2010-0104  
Advisory URL:  
http://www.coresecurity.com/content/landesk-csrf-vulnerability  
Date published: 2010-02-04  
Date of last update: 2010-02-04  
Vendors contacted: LANDesk Team  
Release mode: Coordinated release  
  
  
2. *Vulnerability Information*  
  
Class: Cross site request forgery [CWE-352], Cross site scripting  
[CWE-79], OS command injection [CWE-78]  
Impact: Code execution  
Remotely Exploitable: Yes  
Locally Exploitable: No  
Bugtraq ID: 37905  
CVE Name: CVE-2010-0368, CVE-2010-0369  
  
  
3. *Vulnerability Description*  
  
The LANDesk division of Avocent Corporation [1] provides systems  
management, security management, service desk, asset management, and  
process management solutions to organizations. The company's software  
is used worldwide.  
  
A security vulnerability was discovered in LANDesk Management Suite: a  
cross-site request forgery which allows an external remote attacker to  
make a command injection that can be used to execute arbitrary code  
using the webserver user. As a result, an attacker can remove the  
firewall and load a kernel module, allowing root access to the  
appliance. It also can be used as a non-persistent XSS.  
  
In order to be able to successfully make the attack, the administrator  
must be logged in to the appliance with the browser that the attacker  
uses to make the attack (for instance, exploiting a XSS in a different  
tab in the browser).  
  
  
4. *Vulnerable packages*  
  
. LANDesk Management Gateway 4.0-1.48 (and older)  
. LANDesk Management Gateway 4.2-1.8  
  
  
5. *Non-vulnerable packages*  
  
. LANDesk Management Gateway 4.0-1.61  
. LANDesk Management Gateway 4.2-1.61  
  
  
6. *Vendor Information, Solutions and Workarounds*  
  
The patch name is GSBWEB_61. When applied to versions 4.0 and 4.2 of  
the LANDesk Management Gateway it will bring them to 4.0-1.61 and  
4.2-1.61 respectfully. For additional information contact LANDesk  
support forums [2].  
  
  
7. *Credits*  
  
This vulnerability was discovered and researched by Aureliano Calvo  
and Adrian Manrique from Core Security Technologies.  
  
  
8. *Technical Description / Proof of Concept Code*  
  
The Landesk web application does not sufficiently verify if a  
well-formed request was provided by the user who submitted the  
request. When the web application receives a request to remove a  
previously generated backup from a client, the request will be  
processed by 'gsb/BackupRestoreTab.php', which has the following lines:  
  
/-----  
19 $cmd = "sudo /subin/backuptool --delete {$_POST['delBackupName']}";  
20 exec($cmd);  
21 $msg = "Successfully Removed: {$_POST['delBackupName']}  
- -----/  
  
Thus, it might be possible for an attacker to trick a client into  
making an unintentional request to the web server by handcrafting the  
'delBackupName' parameter. As a result, an attacker can generate and  
send an arbitrary command line ('BackupRestoreTab.php:19') that would  
be executed in the context of the web server ('BackupRestoreTab.php:20').  
  
In order to trigger this vulnerability, a POST request with the  
following parameters must be made to 'gsb/datetime.php':  
  
/-----  
<delBackupName>: 'a; [injection]'  
<backupRestoreFormSubmitted>: 'b'  
- -----/  
  
Using this information an external remote attacker can run arbitrary  
code using the 'gsbadmin' user (that is the user running the  
web-server), but the 'gsbadmin' user has sudo privileges. Looking at  
'/etc/sudoers', you can see that the attacker can also take down the  
firewall (injecting: 'a; sudo /subin/firewall stop' into  
'delBackupName') and load arbitrary kernel modules (injecting 'a; sudo  
/subin/modprobe /tmp/a_module'), effectively taking complete control  
of the server.  
  
In order to be able to successfully make the attack, the administrator  
must be logged in to the appliance with the browser that the attacker  
uses to make the attack (for instance, exploiting a XSS in a different  
tab in the browser).  
  
  
8.1. *Proof of Concept*  
  
This PoC is an HTML form (that can be hosted on any web site) that  
makes a request to the '[server]'. The parameter  
'backupRestoreFormSubmitted' must contain any value in order to  
trigger the vulnerability. The parameter 'delBackupName' contains the  
actual injection. In the example, we generate the file '/tmp/ATTACKED'  
to show that arbitrary shell commands can be executed in the server.  
  
/-----  
<html>  
<head><title>LANDesk PoC</title></head>  
<body>  
<form method="post" action="https://[server]/gsb/datetime.php">  
<input type="text" name="delBackupName" value="; touch  
/tmp/ATTACKED">  
<input type="text" name="backupRestoreFormSubmitted" value="b">  
<input type="submit" value="Attack!">  
</form>  
</body>  
</html>  
- -----/  
  
  
9. *Report Timeline*  
  
. 2010-01-04:  
Core Security Technologies notifies the LANDesk team of the  
vulnerability, setting the estimated publication date of the advisory  
to January 25th 2010.  
  
. 2010-01-05:  
The LANDesk team asks Core for a technical description of the  
vulnerability.  
  
. 2010-01-05:  
Technical details sent to LANDesk by Core.  
  
. 2010-01-05:  
LANDesk notifies Core that they have reproduced and confirmed the  
vulnerability. The vendor also notifies that they have created a  
Change Request in house for this, and that they are currently scoping  
this issue for setting a time for a patch release.  
  
. 2010-01-18:  
Core asks LANDesk team for a status update and reminds the vendor that  
publication of the advisory is scheduled for January 25th.  
  
. 2010-01-18:  
Vendor estimates that it is on track to have the fix ready for  
publication at the end of the month.  
  
. 2010-01-21:  
Core asks LANDesk additional information in order to understand the  
impact of the vulnerability. Core identifies two different flaws:  
  
. CVE-2010-0368 - CSRF  
. CVE-2010-0369 - XSS  
  
but it is not clear whether the vulnerability has to be considered as  
an OS command injection too.  
  
. 2010-01-21:  
LANDesk notifies Core that this flaw is also an OS command injection  
vulnerability, since the privileges to OS are not implied to users who  
login to the web interface.  
  
. 2010-01-22:  
Vendor informs us that the affected versions are LANDesk Management  
Gateway prior to 4.0-1.48 and 4.2-1.8. LANDesk also notifies us that  
the patch for 4.2 versions have been released, but they have ran into  
a snag getting the 4.0 patch out; for that reason, LANDesk asks Core  
to postpone the announcement of the advisory for up to 10 days.  
  
. 2010-01-25:  
Core responds that the announcement can be postponed if the  
information about the vulnerability is not public. Core also asks  
LANDesk for additional information about the released patch for 4.2  
versions.  
  
. 2010-01-26:  
LANDesk responds that the patch is only available to the users of the  
4.2 version of the LANDesk Management Gateway and there was not a  
public announcement for it. The patch is only available for download  
in the LANDesk patch content stream; and that means the patch can only  
be accessed from a LANDesk Management Gateway and is not publically  
viewable. Details of the vulnerability have not been disclosed in the  
patch description.  
  
. 2010-01-29:  
Core notifies LANDesk that the advisory publication have been  
rescheduled for the next Thursday, February 4th.  
  
. 2010-01-29:  
LANDesk notifies they are on schedule to meet the February 4th date.  
  
. 2010-02-03:  
Core asks LANDesk for a status update.  
  
. 2010-02-04:  
LANDesk notifies that a fix has been produced for all affected  
versions and they are ready to make the announcement. LANDesk also  
notifies they are grateful for Core Security Technologies' dedication  
and professionalism to secure computing.  
  
. 2010-02-04:  
The advisory CORE-2010-0104 is published.  
  
  
  
10. *References*  
  
[1] LANDesk website http://www.landesk.com/.  
[2] Vendor information about these issues  
http://community.landesk.com/support/docs/DOC-8333/.  
  
  
11. *About CoreLabs*  
  
CoreLabs, the research center of Core Security Technologies, is  
charged with anticipating the future needs and requirements for  
information security technologies. We conduct our research in several  
important areas of computer security including system vulnerabilities,  
cyber attack planning and simulation, source code auditing, and  
cryptography. Our results include problem formalization,  
identification of vulnerabilities, novel solutions and prototypes for  
new technologies. CoreLabs regularly publishes security advisories,  
technical papers, project information and shared software tools for  
public use at: http://www.coresecurity.com/corelabs.  
  
  
12. *About Core Security Technologies*  
  
Core Security Technologies develops strategic solutions that help  
security-conscious organizations worldwide develop and maintain a  
proactive process for securing their networks. The company's flagship  
product, CORE IMPACT, is the most comprehensive product for performing  
enterprise security assurance testing. CORE IMPACT evaluates network,  
endpoint and end-user vulnerabilities and identifies what resources  
are exposed. It enables organizations to determine if current security  
investments are detecting and preventing attacks. Core Security  
Technologies augments its leading technology solution with world-class  
security consulting services, including penetration testing and  
software security auditing. Based in Boston, MA and Buenos Aires,  
Argentina, Core Security Technologies can be reached at 617-399-6980  
or on the Web at http://www.coresecurity.com.  
  
  
13. *Disclaimer*  
  
The contents of this advisory are copyright (c) 2010 Core Security  
Technologies and (c) 2010 CoreLabs, and may be distributed freely  
provided that no fee is charged for this distribution and proper  
credit is given.  
  
  
14. *PGP/GPG Keys*  
  
This advisory has been signed with the GPG key of Core Security  
Technologies advisories team, which is available for download at  
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.8 (MingW32)  
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/  
  
iEYEARECAAYFAktrUX8ACgkQyNibggitWa0+hgCeJRm5JNFVKJL6FH5AoRcPcRnE  
KOYAn1eXBv0WVTfxPKhgsIKGcPZ/FNNb  
=CEfo  
-----END PGP SIGNATURE-----  
`