| Summary: | Proftpd in Fedora 13 is vulnerable remotely with exploit regcom(3) of http://www.kb.cert.org/vuls/id/912279 | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | xset1980 | ||||||
| Component: | proftpd | Assignee: | Matthias Saou <matthias> | ||||||
| Status: | CLOSED NEXTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | urgent | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 14 | CC: | gholms, matthias, paul | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | i686 | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | proftpd-1.3.4-0.8.rc2.fc15 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2012-03-14 18:31:19 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Attachments: |
|
||||||||
Has this been reported to proftpd upstream (http://www.proftpd.org/bugs.html)? I can't find anything related in bugzilla there. (In reply to comment #1) > Has this been reported to proftpd upstream (http://www.proftpd.org/bugs.html)? > > I can't find anything related in bugzilla there. Paul, The bug is not reported to proftpd, the bug was anounced in seclist.org and securityreason, but for some reason proftpd team did not payed atention to it. References: Seclist.org http://seclists.org/fulldisclosure/2011/Jan/78 Securityreason: http://securityreason.com/exploitalert/9808 I took the exploit from securityreason, to probe that not only the mentioned systems are affected ( Ubuntu 10.10 - Slackware 13 - Gentoo 18.10.2010 - FreeBSD 8.1 (grep(1)) - NetBSD 5.0.2 (grep(1))), but it also affects to any system that uses 'GNU libc/regcomp(3)' and proftpd. The origin of this comes from a bug reported by me with ID:668219. The actual exploit for Proftpd is based in the same bug, encountered in GNU libc/regcomp(3), so, it affects all system that use libc and proftpd, in this case, Fedora, but can be other distro. Original bug libc: http://securityreason.com/securityalert/8003 Exploit based in libc for Proftpd: http://securityreason.com/exploitalert/9808 Author: Maksymilian Arciemowicz The init of the thread is https://bugzilla.redhat.com/show_bug.cgi?id=645859. I believe that if Red Hat does not consider this a security failure but limitation of libc in the handle of regular expresions, then no matters the origin of it, if its libc or whatever, as is still a failure, what Red Hat should do is eliminate the compiled RPM from Fedora's repos, or offer an alternative or recompile the RPM with the fixed libc (whitout GNU libc regcomp(3)). Ramiro. I'm pretty sure this is a duplicate of bug 645859. (In reply to comment #3) > I'm pretty sure this is a duplicate of bug 645859. Well yes it is but the commentary in that bug says that nothing's going to be done about so the onus is on all users of glibc's regex engine to look after themselves. Created attachment 480776 [details]
Potential fix for testing
Upstream are proposing to offer the option of using the PCRE Posix regex compatibility library instead of the system regex library. The attached 32-bit package for Fedora 13 is built using that option. Could you test it and see if it resolves the problem?
Paul, sorry for my delay, but I was offline and technical problems, these days (no more than 3), prove the rpm you just attach. I agree with you, no matter who is the problem, or take proftpd or arranged, CentOS does not include for example, only vsftpd, then, if not done one thing or another, unless the install package that is potentially alert dangerous under some circumstances, not all users know the bug Paul, I tested you rpm and the bug is persitent, proftpd are freezed after attack, and only respond if restart the service, the change with this rpm that you compile, is that the system not overload the CPU. Attacker: 192.168.0.10 Target: 192.168.0.12 /var/log/messages of target: Apr 6 13:01:47 pruebas proftpd[11683]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:01:52 pruebas proftpd[11683]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 6 13:01:59 pruebas proftpd[11684]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:37 pruebas proftpd[11684]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 6 13:02:39 pruebas proftpd[11688]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:39 pruebas proftpd[11690]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:39 pruebas proftpd[11691]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:39 pruebas proftpd[11687]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:39 pruebas proftpd[11686]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:39 pruebas proftpd[11689]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:39 pruebas proftpd[11685]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:40 pruebas proftpd[11693]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:40 pruebas proftpd[11692]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:42 pruebas proftpd[11695]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:42 pruebas proftpd[11698]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:42 pruebas proftpd[11694]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:42 pruebas proftpd[11696]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:42 pruebas proftpd[11699]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:42 pruebas proftpd[11697]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:43 pruebas proftpd[11700]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:43 pruebas proftpd[11701]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:45 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:45 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:45 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:45 pruebas proftpd[11703]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:45 pruebas proftpd[11702]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:45 pruebas proftpd[11704]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 6 13:02:46 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:46 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:48 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:48 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:48 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:48 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:48 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:48 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:49 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:49 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:51 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:51 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:51 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:51 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:51 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:51 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:52 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:52 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Apr 6 13:02:54 pruebas proftpd[11476]: 127.0.0.1 - MaxInstances (20) reached, new connection denied Terminal of attacker: [root@tux test]# ./reg1 192.168.0.12 21 cx password 192.168.0.10 This is exploit for ERE (GNU libc) by Maksymilian Arciemowicz send: USER cx PASS password send: STAT . send: USER cx PASS password send: STAT . send: USER cx PASS password send: STAT . ^C My suggestion is that proftpd is removed from the repositories and offered vsftpd which is not vulnerable to this exploit, until proftpd team can not resolve the bug. Fedora is a distro for end users and not all people know this bug, and run proftpd, is a big error, CentOS only have vsftpd in repos. Greets Can you try this one and see if it's any better? http://mirror.city-fan.org/ftp/contrib/misc/proftpd-1.3.4-0.7.0.cf.rc2.fc13.i686.rpm proftpd-1.3.4-0.7.rc2.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/proftpd-1.3.4-0.7.rc2.fc15 (In reply to comment #8) > Can you try this one and see if it's any better? > > http://mirror.city-fan.org/ftp/contrib/misc/proftpd-1.3.4-0.7.0.cf.rc2.fc13.i686.rpm Paul, Tested with: http://mirror.city-fan.org/ftp/contrib/misc/proftpd-1.3.4-0.7.0.cf.rc2.fc13.i686.rpm OS: Fedora 13 i686 This rpm work fine, /var/log/messages of target: [root@pruebas ~]# tail -f /var/log/messages Apr 7 17:20:21 pruebas proftpd[1886]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:21 pruebas proftpd[1883]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:21 pruebas proftpd[1887]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:21 pruebas proftpd[1883]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:21 pruebas proftpd[1888]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:21 pruebas proftpd[1884]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:21 pruebas proftpd[1890]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:21 pruebas proftpd[1889]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:21 pruebas proftpd[1890]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:21 pruebas proftpd[1889]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:24 pruebas proftpd[1893]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:24 pruebas proftpd[1892]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:24 pruebas proftpd[1894]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:24 pruebas proftpd[1895]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:24 pruebas proftpd[1896]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:24 pruebas proftpd[1897]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:24 pruebas proftpd[1894]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:24 pruebas proftpd[1892]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:24 pruebas proftpd[1896]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:24 pruebas proftpd[1893]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:24 pruebas proftpd[1895]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:24 pruebas proftpd[1897]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:24 pruebas proftpd[1898]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:24 pruebas proftpd[1899]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. Apr 7 17:20:24 pruebas proftpd[1899]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:24 pruebas proftpd[1898]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session closed. Apr 7 17:20:27 pruebas proftpd[1903]: 127.0.0.1 (192.168.0.10[192.168.0.10]) - FTP session opened. And the attacker stop the attack after X reintents, if stop the exploit, the ftp service in port 21 is ok without need of restarting the service in the target-server. CPU load is fine, and there are no consecuences in the server after using the exploit regcomp(3). Great job.- That's upstream's fix (using pcre instead of glibc regexp library) and it'll be in 1.3.4; rc2 is already in F-15 and Rawhide with this support but I'm not pushing the update to stable releases until 1.3.4 final comes out. proftpd-1.3.4-0.8.rc2.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/proftpd-1.3.4-0.8.rc2.fc15 proftpd-1.3.4-0.8.rc2.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report. This message is a reminder that Fedora 13 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 13. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '13'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 13's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 13 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping Fedora 14 is still affected by this issue, and will be until upstream releases 1.3.4 final. Paul, Is solved in f14?. f14 is supported for the moment. Not in f14; upstream has not released 1.3.4 final yet. This is fixed in all supported Fedora releases now. |
Created attachment 475533 [details] Screenshot of status proftpd after exploit, steps, source code, and refused connection after exploit caused DoS on remote server Description of problem: "proftpd multiple exploit for VU#912279 (only with GNU libc/regcomp(3)) by Maksymilian Arciemowicz" This bug was reported, so it affected only Ubuntu, Gentoo, Slackware and others. I report the bug by using grep segfault was happening in Fedora 13, something not reported by the who wrote the bug. Also, redhat somehow implied that was a bug in glibc, and thus was not the relevant, which shows they are wrong. While CentOS, which is a true copy of redhat repos only brings in vsftpd, proftpd has Fedora, widely used in truth, which was exposed by my exploit the same supposedly only affected ubuntu, gentoo and slackware, leading to positive a denial of service permanently until the remote service is restarted. Was tested on Fedora 13 i686 text-only mode with a user without a shell, only with access to your home. Version-Release number of selected component (if applicable): Proftpd 1.3.3c How reproducible: Compile the remote exploit and launch to a proftpd server running. Steps to Reproduce: 1.compile exploit with gcc 2.launch exploit to proftpd server 3.proftpd cause an DoS and crash the service, refusing all connection. Actual results: DoS of proftpd Expected results: Not crash, not vulnerable! Additional info: Attach of screen, source exploit, and result later launch exploit, image and text.