Penetration Test Report (X41 D-Sec): X41 OSTIF c ares Code Review 2023 Public

SourceCodeAuditonc-ares
forOpenSourceTechnologyImprovementFund(OSTIF)
FinalReportandManagementSummary
2023-05-22
X41 D-SEC GmbH
Krefelder Str. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
OrganizedbytheOpenSourceTechnologyImprovementFund
SourceCodeAuditonc-ares forOpenSourceTechnologyImprovementFund(OSTIF)
Revision Date Change Author(s)
1 2023-04-14 FinalReport MSc. H.Moesl,Dipl.-Ing. D.Gstir,R.
Weinberger,andM.Vervier
2 2023-05-25 PublicReport MSc. H.Moesl,Dipl.-Ing. D.Gstir,R.
Weinberger,andM.Vervier
X41D-SecGmbH PUBLIC Page1of51
SourceCodeAuditonc-ares forOpenSourceTechnologyImprovementFund(OSTIF)
Contents
1 ExecutiveSummary 4
1.1 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2 Introduction 7
2.1 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3 RatingMethodologyforSecurityVulnerabilities 11
3.1 CommonWeaknessEnumeration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4 Results 13
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
5 AboutX41D-SecGmbH 28
A FuzzingHarnesses 29
A.1 CLIFuzzingofacountry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
A.2 CLIFuzzingofadigandahost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
A.3 TestHarnessforParseFunctions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
A.4 TestHarnessStringOperationFunctions . . . . . . . . . . . . . . . . . . . . . . . . 35
A.5 TestHarnessforFileandStringParsingFunctions . . . . . . . . . . . . . . . . . . . 40
A.6 OtherTestHarnesses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
A.7 CrashingTestHarnessares_set_sortlist . . . . . . . . . . . . . . . . . . . . . . . . . 49
X41D-SecGmbH PUBLIC Page2of51
SourceCodeAuditonc-ares forOpenSourceTechnologyImprovementFund(OSTIF)
Dashboard
Target
Customer OpenSourceTechnologyImprovementFund(OSTIF)
Name c-ares
Type SourceCode
Version commit(f95ca36cde8cbbf90860d7b5403e3efb69f8b0f7)
Engagement
Type SourceCodeAudit
Consultants 3:MSc.H.Moesl,Dipl.-Ing.D.Gstir,andR.Weinberger
EngagementEffort 15person-days,2023-03-13to2023-04-12
Totalissuesfound 3
Critical - 0
High - 0
CWE-124(1)
Medium - 3
CWE-330(2)
Low - 0
None - 3
0 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6 2.8 3
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of51
SourceCodeAuditonc-ares forOpenSourceTechnologyImprovementFund(OSTIF)
1 Executive Summary
InMarchandApril2023,X41D-SecGmbHperformedasourcecodeauditagainstc-arestoiden-
tifyvulnerabilitiesandweaknessesinthesourcecodeandspecification. Thetestwasorganized
bytheOpenSourceTechnologyImprovementFund1.
A total of three vulnerabilities were discovered during the audit by X41. None were rated as
having a critical or high severity, three as medium, and none as low. Additionally, three issues
withoutadirectsecurityimpactwereidentified.
Medium - 3
Figure1.1:IssuesandSeverity
Thec-areslibraryisalibraryforasynchronousDNSrequests(includingnameresolves)writtenin
C.Asitiscommonforcompiledlanguages,aparticularfocushasbeenplacedontheidentification
oftypicalmemorycorruptionvulnerabilitiessuchasoutofboundsmemoryaccess,information
leaks,ortemporalmemorysafetyviolationssuchasuse-after-freeconditions.
1https://ostif.org
X41D-SecGmbH PUBLIC Page4of51
SourceCodeAuditonc-ares forOpenSourceTechnologyImprovementFund(OSTIF)
Inasourcecodeaudit,thetestersreceiveallavailableinformationaboutthetarget.Thetestwas
performedbythreeexperiencedsecurityexpertsbetween2023-03-13and2023-04-12.
Despitemultipleauditorsindependentlyreviewingthesamesectionofthecodeforbettercover-
age,onlythreevulnerabilitieswereidentifiedduringthereviewprocess. Theseparticularissues
pertain to the fact that the c-ares library does not employ a secure random number generator
whengeneratingakeythatisusedforgeneratingDNSqueryIDsduringcross-compilation.While
thesevulnerabilitiesdonotposeacriticalsecuritythreat,itcouldpotentiallybeexploitedbyat-
tackers to launch DNS cache poisoning attacks on certain targets. Therefore, addressing this
vulnerabilitycanaddanadditionallayerofdefenseandhelpreducethepotentialattacksurface
ofthelibrary. Overall,thecurrentlogicforselectingarandomsourceshouldberedesignedand
hardenedtouseasecurerandomsourceonallUNIXandsimilarsystems.
To further improve the security posture, it is encouraged to implement additional security con-
trols, which have been listed as part of the Informational Notes list. These describe potential
improvementswithregardstomissingreturnvaluechecks.
Itisworthemphasizingthatthec-areslibrarywasputthroughrigoroustestingbyX41’steamand,
overall,itwasfoundtobehighlyrobustandsecure.Thetestingprocessrevealedthatthec-ares
libraryisdesignedandimplementedwithgreatcareandattentiontodetail,anditdemonstrated
a strong ability to withstand scrutiny. As a result, the overall impression and outcome of this
securityassessmentisverypositive.
Again,itmustbereiteratedthatthisassessmentprovidedvaluableinsightsintothesecuritypos-
tureatthetimeoftesting,butitisimportanttonotethatanypenetrationtestisunabletoguar-
anteethatthesoftwarecomplexisfreeofadditionalbugs.
Intermsofdynamictesting,thetestingteamdevelopedseveralfuzztestingharnesses.Fuzztest-
ingis,ingeneral,essentialfortheoverallsecurityofthec-areslibraryproject,especiallysinceit
isimplementedinC,whichisoftenpronetomemorycorruptionvulnerabilities.Forthepurpose
of this test, code coverage driven fuzzing using AFL++ in combination with address space sani-
tizers(suchasASAN)hasbeenperformed.Eventhoughnonewissueswereidentifiedusingthe
developedharnesses,itishighlyrecommendedtoincorporatethedevelopedharnessesintothe
c-areslibraryandtomakefuzzingafixedpartofthec-aressoftwareproject,eitherusingAFL++
orlibFuzzer,resultinginbettertestingcoverage.
X41D-SecGmbH PUBLIC Page5of51
SourceCodeAuditonc-ares forOpenSourceTechnologyImprovementFund(OSTIF)
1.1 Findings Overview
DESCRIPTION SEVERITY ID REF
Useofrand()YieldsPredictableDNSQueryIDs MEDIUM CARES-CR-23-01 4.1.1
Useof(Erroneous)RC4ForRandomNumberGeneration MEDIUM CARES-CR-23-02 4.1.2
StackBufferUnderflowin MEDIUM CARES-CR-23-03 4.1.3
funcares_set_sortlist()
MissingCheckof NONE CARES-CR-23-100 4.2.1
funcares_malloc()ReturnValue
MissingCheckof NONE CARES-CR-23-101 4.2.2
funcsnprintf()ReturnValue
MissingCleanupinc-aresTool NONE CARES-CR-23-102 4.2.3
funcadig
Table1.1:Security-RelevantFindings
X41D-SecGmbH PUBLIC Page6of51
SourceCodeAuditonc-ares forOpenSourceTechnologyImprovementFund(OSTIF)
2 Introduction
Theassessmentcomprisedasecurityreviewofthec-areslibrary,utilizingstaticsourcecodeanal-
ysisaswellasdynamictestingusingdedicatedfuzztestingharnesses.Thebranchinscopeforthis
inspectionwasthemainbranchwiththecommitidf95ca36cde8cbbf90860d7b5403e3efb69f8b0f7.
Atthebeginningoftheproject, aninitialkick-offmeetingwassetupbetweenX41, OSTIFand
themaintainersofthelibraryinordertotoalignonthescopeofthisengagement. Themeeting
helpedtoclarifytheexpectationsofthisassessmentandalsonarroweddownthekeyfocusareas.
ThroughouttheengagementthetesterswereincommunicationwithOSTIFandthemaintainers
ofthelibrarythroughadedicatedSignalgroup.Thecommunicationwasexcellent,andhelpwas
providedwheneverrequested.Generallyspeaking,OSTIFaswellasthemaintainersofthelibrary
deservealotofpraisefortheiroverallsupportandassistance. Itwasapleasureforthetesting
team working with them. From a programming style and software design perspective the code
anddesigniscleanandverywellwrittenwithsecurityinmind.
2.1 Scope
Duringthekickoffcall,thetestingteam,incollaborationwithOSTIFandthemaintainers,defined
and narrowed down the scope of the