========================================================
.::PROFTPD v1.3.5a Heap / Malloc Vulnerabilities ::.
ADVANCED INFORMATION SECURITY CORPORATION
Credit: Nicholas Lemonias
Date: 29/11/2015
=========================================================
a888b.
d888888b.
8P"YP"Y88
888|o||o|88
888' .888
888`._.' Y8.
d/ `8b.
dP . Y88b.
d8:' " `::888b
d8" 'Y88b
:8P ' :888
888a. : _888P
._/"Yaa_: .| 88P|
\ YE" `| 8H `.
/ \.___.d| .'
`--..__)888P`._.'
Keeping Things Simple!
==================
INTRODUCTION
==================
ProFTPD is Free and open-source software, compatible with Unix-like
systems and Microsoft Windows (via Cygwin). Along with vsftpd and
Pure-FTPd, ProFTPD is among the most popular FTP servers in Unix-like
environments today. Compared to those, which focus e.g. on simplicity,
speed or security, ProFTPD's primary design goal is to be a highly
feature rich FTP server, exposing a large amount of configuration
options to the user
====================================================
Description: During a manual source code audit of ProFTPD latest,
various security issues were discovered.
=====================================================
===========================
CODE SNIPPET (PoC 1)
===========================
../../mod_sftp/fxp.c:1217-1251
static struct fxp_extpair *fxp_msg_read_extpair(pool *p, unsigned char **buf,
uint32_t *buflen) {
uint32_t namelen, datalen;
unsigned char *name, *data;
struct fxp_extpair *extpair;
namelen = sftp_msg_read_int(p, buf, buflen);
if (*buflen < namelen) {
(void) pr_log_writefile(sftp_logfd, MOD_SFTP_VERSION,
"SFTP message format error: unable to read %lu bytes of extpair name "
"data (buflen = %lu)", (unsigned long) namelen, (unsigned long) *buflen);
SFTP_DISCONNECT_CONN(SFTP_SSH2_DISCONNECT_BY_APPLICATION, NULL);
}
name = palloc(p, namelen + 1);
memcpy(name, *buf, namelen);
(*buf) += namelen;
(*buflen) -= namelen;
name[namelen] = '\0';
datalen = sftp_msg_read_int(p, buf, buflen);
if (datalen > 0) {
data = sftp_msg_read_data(p, buf, buflen, datalen);
} else {
data = NULL;
}
extpair = palloc(p, sizeof(struct fxp_extpair));
extpair->ext_name = (char *) name;
extpair->ext_datalen = datalen;
extpair->ext_data = data;
return extpair;
}
=====================
RATIONALE
=====================
Part of the SFTP handshake involves "extensions", which are key/value
pairs, comprised of strings. In SSH, strings are encoded for network
transport as a 32-bit length, followed by the bytes.
The mod_sftp module has no manual bounds/length metrics / limitations
when reading SFTP extension key/value data from the network.
A malicious attacker might attempt to encode large values, and
allocate more memory than is necessary, cause memory exhaustion.
=======================
CONCLUSION
=======================
To avoid undue resource exhaustion by a remote client, mod_sftp should
include a patch on the maximum length of acceptable extension
keys/values, as reported by our earlier Proftpd report.
==============================
REPORT TIMELINE
==============================
22/11/2015 Reported to vendor. (Initial Report)
25/11/2015 Second report to vendor.
29/11/2015 Bug Report / Patch circulation.
==============================
ACKNOWLEDGEMENTS
==============================
PacketStorm Security,
TEAM TESO, w00w00, Netric, b0iler (eyeonsecurity), wootehfoot,
badpack3t (SP), Vandal (Vic), s0kket, mantis, Big_Al , ELFQrin, bob
(dtors), epic for their ~ legendary mark.
Big Thanks to TJ from Proftpd for the prompt response to the issue,
and excellent cooperation in security
matters.
====================
REFERENCES
====================
[1] Proftpd. 2015. Proftpd Bug Report , MOD_SFTP Heap Overflow.
[ONLINE] Available at:
http://bugs.proftpd.org/show_bug.cgi?id=4210. [Accessed 29 November 2015].
[2] Lemonias, N. (2015). SecurityFocus - Proftpd Heap Overflow. [ONLINE]
Securityfocus.com. Available at:
http://www.securityfocus.com/archive/1/536953/30/0/threaded
[Accessed 29 November 2015].
