ASG-Sentry <= 7.0.0 Multiple Remote Vulnerabilities

🗓️ 11 Mar 2008 00:00:00Reported by RootType
ASG-Sentry <= 7.0.0 multiple remote vulnerabilities. Allows creation of index files and arbitrary file deletion

                                                #######################################################################

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Luigi&nbsp;Auriemma

Application:&nbsp;&nbsp;ASG-Sentry
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.asg-sentry.com
Versions:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;=&nbsp;7.0.0
Platforms:&nbsp;&nbsp;&nbsp;&nbsp;Windows&nbsp;and&nbsp;Unix
Bugs:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;A]&nbsp;arbitrary&nbsp;files&nbsp;deleting
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;B]&nbsp;heap-overflow&nbsp;in&nbsp;FxAgent
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;C]&nbsp;termination&nbsp;of&nbsp;FxIAList
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;D]&nbsp;buffer-overflow&nbsp;in&nbsp;FxIAList
Exploitation:&nbsp;remote
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;10&nbsp;Mar&nbsp;2008
Author:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Luigi&nbsp;Auriemma
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;e-mail:&nbsp;[email protected]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;web:&nbsp;&nbsp;&nbsp;&nbsp;aluigi.org


#######################################################################


1)&nbsp;Introduction
2)&nbsp;Bugs
3)&nbsp;The&nbsp;Code
4)&nbsp;Fix


#######################################################################

===============
1)&nbsp;Introduction
===============


&gt;From&nbsp;vendor's&nbsp;website:
&quot;The&nbsp;ASG-Sentry&nbsp;family&nbsp;of&nbsp;products&nbsp;is&nbsp;a&nbsp;suite&nbsp;of&nbsp;tools&nbsp;strategically
engineered&nbsp;to&nbsp;control,&nbsp;monitor,&nbsp;manage,&nbsp;and&nbsp;enhance&nbsp;your&nbsp;network.
Sentry's&nbsp;tools&nbsp;provide&nbsp;you&nbsp;with&nbsp;full&nbsp;visibility&nbsp;to&nbsp;your&nbsp;network&nbsp;from
any&nbsp;Web&nbsp;browser.&nbsp;Sentry&nbsp;also&nbsp;allows&nbsp;you&nbsp;to&nbsp;fully&nbsp;instrument&nbsp;your
company's&nbsp;applications,&nbsp;CPUs,&nbsp;disk&nbsp;space,&nbsp;memory,&nbsp;files,&nbsp;Windows&nbsp;and
UNIX&nbsp;platforms,&nbsp;and&nbsp;more.&quot;


#######################################################################

=======
2)&nbsp;Bugs
=======

---------------------------
A]&nbsp;arbitrary&nbsp;files&nbsp;deleting
---------------------------

The&nbsp;fcheck.exe&nbsp;(File&nbsp;Check&nbsp;Utility)&nbsp;CGI&nbsp;available&nbsp;in&nbsp;ASG&nbsp;is&nbsp;used&nbsp;for
handling&nbsp;some&nbsp;index&nbsp;files&nbsp;which&nbsp;contain&nbsp;a&nbsp;list&nbsp;of&nbsp;filenames&nbsp;and
checksums.

The&nbsp;-b&nbsp;option&nbsp;of&nbsp;this&nbsp;utility&nbsp;allows&nbsp;the&nbsp;creation&nbsp;of&nbsp;these&nbsp;index&nbsp;files
and&nbsp;is&nbsp;possible&nbsp;to&nbsp;specify&nbsp;both&nbsp;the&nbsp;name&nbsp;of&nbsp;the&nbsp;output&nbsp;file&nbsp;and,
optionally,&nbsp;the&nbsp;folder&nbsp;which&nbsp;will&nbsp;be&nbsp;scanned&nbsp;recursively&nbsp;for&nbsp;finding
and&nbsp;reading&nbsp;the&nbsp;various&nbsp;files&nbsp;to&nbsp;add&nbsp;to&nbsp;the&nbsp;list.

The&nbsp;first&nbsp;vulnerability&nbsp;is&nbsp;in&nbsp;the&nbsp;possibility&nbsp;for&nbsp;an&nbsp;external&nbsp;attacker
to&nbsp;use&nbsp;this&nbsp;CGI&nbsp;for&nbsp;overwriting&nbsp;existent&nbsp;files&nbsp;with&nbsp;no&nbsp;data&nbsp;(specifying
a&nbsp;new&nbsp;folder&nbsp;which&nbsp;will&nbsp;be&nbsp;created&nbsp;by&nbsp;the&nbsp;same&nbsp;program)&nbsp;or&nbsp;with&nbsp;the
list&nbsp;of&nbsp;filenames&nbsp;described&nbsp;before.
Naturally&nbsp;is&nbsp;possible&nbsp;to&nbsp;specify&nbsp;both&nbsp;files&nbsp;on&nbsp;the&nbsp;local&nbsp;disks&nbsp;or&nbsp;on
network&nbsp;shares.

The&nbsp;second&nbsp;effect&nbsp;instead&nbsp;is&nbsp;the&nbsp;possibility&nbsp;of&nbsp;occupying&nbsp;CPU&nbsp;and&nbsp;disk
for&nbsp;the&nbsp;scanning&nbsp;of&nbsp;any&nbsp;file&nbsp;in&nbsp;the&nbsp;disk&nbsp;simply&nbsp;specyfing,&nbsp;for&nbsp;example,
c:\&nbsp;as&nbsp;folder.


---------------------------
B]&nbsp;heap-overflow&nbsp;in&nbsp;FxAgent
---------------------------

The&nbsp;FxAgent&nbsp;process&nbsp;running&nbsp;on&nbsp;UDP&nbsp;port&nbsp;6161&nbsp;is&nbsp;used&nbsp;for&nbsp;handling&nbsp;the
various&nbsp;SNMP&nbsp;requests.
A&nbsp;community&nbsp;field&nbsp;longer&nbsp;than&nbsp;64&nbsp;bytes&nbsp;can&nbsp;be&nbsp;used&nbsp;by&nbsp;an&nbsp;attacker&nbsp;to
exploit&nbsp;a&nbsp;heap-overflow.


--------------------------
C]&nbsp;termination&nbsp;of&nbsp;FxIAList
--------------------------

FxIAList&nbsp;is&nbsp;a&nbsp;service&nbsp;which&nbsp;runs&nbsp;on&nbsp;the&nbsp;TCP&nbsp;port&nbsp;6162&nbsp;and&nbsp;is&nbsp;used&nbsp;for
the&nbsp;logging&nbsp;operations&nbsp;which&nbsp;include&nbsp;the&nbsp;commands&nbsp;&quot;exit&quot;,&nbsp;&quot;trace&nbsp;on&quot;
&quot;verbose&quot;,&nbsp;&quot;trace&nbsp;off&quot;&nbsp;and&nbsp;the&nbsp;name&nbsp;of&nbsp;the&nbsp;log&nbsp;file&nbsp;to&nbsp;create
(xxxx.xx.xx)&nbsp;and&nbsp;its&nbsp;content.
The&nbsp;main&nbsp;problem&nbsp;is&nbsp;that&nbsp;the&nbsp;server&nbsp;doesn't&nbsp;require&nbsp;authentication&nbsp;so
anyone&nbsp;can&nbsp;send&nbsp;the&nbsp;&quot;exit&quot;&nbsp;command&nbsp;and&nbsp;the&nbsp;service&nbsp;will&nbsp;just&nbsp;terminate.


------------------------------
D]&nbsp;buffer-overflow&nbsp;in&nbsp;FxIAList
------------------------------

The&nbsp;same&nbsp;service&nbsp;described&nbsp;before&nbsp;is&nbsp;affected&nbsp;also&nbsp;by&nbsp;a&nbsp;stack&nbsp;based
buffer-overflow&nbsp;which&nbsp;happens&nbsp;during&nbsp;the&nbsp;copying&nbsp;of&nbsp;the&nbsp;data&nbsp;we&nbsp;want
to&nbsp;write&nbsp;to&nbsp;the&nbsp;log&nbsp;file&nbsp;(max&nbsp;1023&nbsp;bytes)&nbsp;in&nbsp;a&nbsp;buffer&nbsp;of&nbsp;only&nbsp;500.


#######################################################################

===========
3)&nbsp;The&nbsp;Code
===========


http://aluigi.org/poc/asgulo.zip
http://milw0rm.com/sploits/2008-asgulo.zip

A]
&nbsp;&nbsp;http://SERVER:6161/snmx-cgi/fcheck.exe?-b+..\../..\boot.ini
&nbsp;&nbsp;http://SERVER:6161/snmx-cgi/fcheck.exe?-b+c:\windows\win.ini
&nbsp;&nbsp;http://SERVER:6161/snmx-cgi/fcheck.exe?-b+c:\file.txt+c:\
&nbsp;&nbsp;http://SERVER:6161/snmx-cgi/fcheck.exe?-b+\host\document.txt
&nbsp;&nbsp;&nbsp;&nbsp;this&nbsp;link&nbsp;for&nbsp;the&nbsp;network&nbsp;share&nbsp;is&nbsp;correct&nbsp;because&nbsp;Apache&nbsp;converts
&nbsp;&nbsp;&nbsp;&nbsp;any&nbsp;backslash&nbsp;to&nbsp;double&nbsp;so&nbsp;that&nbsp;one&nbsp;becomes&nbsp;\\host\\document.txt

B]
&nbsp;&nbsp;nc&nbsp;SERVER&nbsp;6161&nbsp;-v&nbsp;-v&nbsp;-u&nbsp;&lt;&nbsp;asgulo_fxagent.txt

C]
&nbsp;&nbsp;nc&nbsp;SERVER&nbsp;6162&nbsp;-v&nbsp;-v&nbsp;-w&nbsp;1&nbsp;&lt;&nbsp;asgulo-ialist1.txt

D]
&nbsp;&nbsp;nc&nbsp;SERVER&nbsp;6162&nbsp;-v&nbsp;-v&nbsp;-w&nbsp;1&nbsp;&lt;&nbsp;asgulo-ialist2.txt


#######################################################################

======
4)&nbsp;Fix
======


No&nbsp;fix


#######################################################################
11 Mar 2008 00:00Current
7.1High risk
Vulners AI Score7.1
ASG-Sentry &lt;= 7.0.0 Multiple Remote Vulnerabilities

ASG-Sentry <= 7.0.0 Multiple Remote Vulnerabilities
