Date: Mon, 3 Dec 2001 11:26:20 +0100 (CET) From: Konrad Heuer <kheuer@gwdu60.gwdg.de> To: Przemyslaw Frasunek <venglin@freebsd.lublin.pl> Cc: freebsd-security@freebsd.org Subject: Re: ISSalert: ISS Security Alert: WU-FTPD Heap Corruption Vulnerability (fwd) Message-ID: <20011203112522.J1350-100000@gwdu60.gwdg.de> In-Reply-To: <200112011125.fB1BPjf74314@mailhost.freebsd.lublin.pl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 1 Dec 2001, Przemyslaw Frasunek wrote:
> On Friday 30 November 2001 09:53, Konrad Heuer wrote:
> > Any opinions whether wu-ftpd on FreeBSD is vulnerable too? To my mind, it
> > seems so.
>
> actually, wu-ftpd on FreeBSD is vulnerable, but phk-malloc design prevents
> from exploiting this. typical scenario of exploitation on linux box is:
>
> - attacker populates heap with pointers to proctitle buf by calling few times
> 'STAT ~{ptrptrptrptr'
>
> - after that, attacker does 'STAT {~' which calls two times blockfree() in
> ftpglob() and malicious 'ptr' is passed to free()
>
> - in proctitle buf there is a fake malloc chunk, pointing to syslog() GOT
> entry and shellcode, also located in proctitle buf
>
> - free() when trying to deallocate fake chunk overwrites pointer to syslog()
> function and then segfaults
>
> - segfault sighandler calls syslog() and shellcode is executed
>
> as you can see, exploitation of this vulnerability isn't so simple. after
> spending long hours with gdb, looks like it's exploitable only on dlmalloc
> from glibc.
Thank you very much for your help which made a patch possible!
Best regards
Konrad
Konrad Heuer Personal Bookmarks:
Gesellschaft für wissenschaftliche
Datenverarbeitung mbH GÖttingen http://www.freebsd.org
Am Faßberg, D-37077 GÖttingen http://www.daemonnews.org
Deutschland (Germany)
kheuer@gwdu60.gwdg.de
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011203112522.J1350-100000>