iDEFENSE Security Advisory 02.21.05: Multiple PuTTY SFTP Client Packet Parsing Integer Overflow Vulnerabilities
Multiple PuTTY SFTP Client Packet Parsing Integer Overflow
Vulnerabilities
iDEFENSE Security Advisory 02.21.05:
www.idefense.com/application/poi/display?id=201&type=vulnerabilities
February 21, 2005
I. BACKGROUND
PuTTY is a free implementation of Telnet and SSH for Win32 and Unix
platforms, along with an xterm terminal emulator.
More information is available on the vendor's website:
http://www.chiark.greenend.org.uk/~sgtatham/putty/
II. DESCRIPTION
Remote exploitation of multiple integer overflow vulnerabilities in
Simon Tatham's PuTTY can allow attackers to execute arbitrary code.
The first vulnerability specifically exists due to insufficient
validation of user-supplied data passed to a memcpy function. The PuTTY
sftp implementation allows attackers to supply arbitrary values for the
stored length of the string in the packet. This may be observed in the
sftp_pkt_getstring() function from sftp.c in PuTTY source code:
static void sftp_pkt_getstring(struct sftp_packet *pkt,
char **p, int *length)
{
*p = NULL;
if (pkt->length - pkt->savedpos < 4)
return;
/* length value is taken from user-supplied data */
*length = GET_32BIT(pkt->data + pkt->savedpos);
pkt->savedpos += 4;
/* this check will be passed if length < 0 */
if (pkt->length - pkt->savedpos < *length)
return;
*p = pkt->data + pkt->savedpos;
pkt->savedpos += *length;
}
This function is called from fxp_open_recv() and passes the returned
string pointer and string length to the mkstr() function:
struct fxp_handle *fxp_open_recv(struct sftp_packet *pktin,
struct sftp_request *req)
{
...
/* sftp_pkt_getstring call with controlled len value */
sftp_pkt_getstring(pktin, &hstring, &len);
...
handle = snew(struct fxp_handle);
/* heap corruption will occur if len == -1 */
handle->hstring = mkstr(hstring, len);
handle->hlen = len;
sftp_pkt_free(pktin);
return handle;
...
}
If length is passed as -1, a malloc(0) will occur when the snewn() macro
is called:
static char *mkstr(char *s, int len)
{
/* malloc(0) if len == -1 */
char *p = snewn(len + 1, char);
/* user controlled heap corruption */
memcpy(p, s, len);
p[len] = '\0';
return p;
}
Finally, when the memcpy function is called heap corruption will occur
leading to potential code execution.
The second vulnerability specifically exists due to insufficient
validation of user-supplied data passed to a malloc function. This may
be observed in the fxp_readdir_recv() function from PuTTY source code:
struct fxp_names *fxp_readdir_recv(struct sftp_packet *pktin,
struct sftp_request *req) {
/* 32 bit value from packet */
ret->nnames = sftp_pkt_getuint32(pktin);
/*
* The integer overflow occurs when ret->nnames is referenced
* the snewn macro calls malloc() wrapper
* #define snewn(n, type) ((type *)smalloc((n)*sizeof(type)))
*/
ret->names = snewn(ret->nnames, struct fxp_name);
for (i = 0; i < ret->nnames; i++) {
char *str;
int len;
sftp_pkt_getstring(pktin, &str, &len);
/* pointer to arbitrary data from packet */
ret->names[i].filename = mkstr(str, len);
sftp_pkt_getstring(pktin, &str, &len);
/* pointer to arbitrary data from packet */
ret->names[i].longname = mkstr(str, len);
/* pointer to arbitrary data from packet */
ret->names[i].attrs = sftp_pkt_getattrs(pktin);
}
This function is called from scp_get_sink_action() in scp.c and
sftp_cmd_ls() in sftp.c and can lead to remote code execution via heap
corruption. Sample debugger output of heap corruption is shown below:
psftp> ls
Listing directory /home/test
Program received signal SIGSEGV, Segmentation fault.
0x4009173c in memcpy () from /lib/libc.so.6
(gdb) bt
#0 0x4009173c in memcpy () from /lib/libc.so.6
#1 0x0805675f in mkstr (s=0x4e20 <Address 0x4e20 out of bounds>, len=0)
#2 0x0805748e in fxp_readdir_recv (pktin=0x809bc10, req=0x4e20)
#3 0x0804f7b8 in sftp_cmd_ls (cmd=0x4e20) at ../psftp.c:251
#4 0x08051955 in do_sftp (mode=0, modeflags=0, batchfile=0x0)
#5 0x080525f8 in psftp_main (argc=4, argv=0xbffff494)
#6 0x08080500 in main (argc=20000, argv=0x4e20)
(gdb) up 2
#2 0x0805748e in fxp_readdir_recv (pktin=0x809bc10, req=0x4e20)
952 ret->names[i].filename = mkstr(str, len);
(gdb) x/8x *(int)pktin
0x80acc58: 0x01000068 0x66666600 0x00000067 0x42424208
0x80acc68: 0x42424242 0x00000042 0x44444408 0x44444444
(gdb) print (struct sftp_packet)pktin
$2 = {data = 0x809bc10 "XÌ\n\bYF", length = 134885120,
maxlen = -1073744968, savedpos = 134551097, type = 134885088}
III. ANALYSIS
Successful exploitation allows remote attackers to execute arbitrary
code under the privileges of the user running PuTTY. The client must be
directed to connect to a malicious server in order to trigger the
vulnerability. It should be noted that this vulnerability may affect
applications which use PuTTY source code or binaries as a SSH protocol
backend. An example of one such product would be WinSCP3, a popular
graphical sftp/scp application for Windows.
IV. DETECTION
iDEFENSE has confirmed that PuTTY 0.56 is vulnerable. It is suspected
that earlier versions are also vulnerable.
The following vendors distribute susceptible PuTTY packages within
their respective operating system distributions:
* FreeBSD Project:
FreeBSD 4.9, 4.10, 5.0, 5.1 and 5.2.1
* Gentoo Foundation Inc.:
Gentoo Linux 1.1a, 1.2, 1.4, 2004.0, 2004.1 and 2004.2
V. WORKAROUND
Use an alternate SSH client to connect to untrusted hosts until the
vendor releases a patch.
VI. VENDOR RESPONSE
Vendor advisories for these issues are available at:
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2005-0467 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
02/18/2005 Initial vendor notification
02/19/2005 Initial vendor response
02/21/2005 Public disclosure
IX. CREDIT
Gaël Delalleau credited with this discovery.
Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp
X. LEGAL NOTICES
Copyright © 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@xxxxxxxxxxxx for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.