NODE 8e3d1188NIS library code exposure
Phil Karlton <karlton@netscape.com>Wed, 27 Sep 95 21:02:43 PDT
Once again I speak for myself and not Netscape.
While investigating one of the crashes we ended up decompling some of
the code in the C library. It turns out that in some UNIX systems, the
code in gethostbyname_yp will copy the hostname argument onto a stack
local buffer. That buffer appears to be of size MAXHOSTNAMELEN. [This
is very efficient code at destroying the stack: it does not use strcpy
or sprintf; there is an inline loop copying characters until it finds a
NUL.]
An unstated (in any documentaton I could find) limitation on calls to
gethostbyname is that the "name" parameter must be a limited size
string for it to work at all. I suspect this bug has been in the NIS
(nee YP) code for some time.
Do you have any daemons that run as root and do networking? Are you
sure that all of them check the length of the host name before passing
it to gethostbyname?
[Avoid the fencepost error: MAXHOSTNAMELEN is really the size of the
buffer and not the maximal string length. You need room for the
trailing NUL.]
We have not looked into the networking libraries that are typically
found on a PC or Macintosh. The exposure may also be present there.
PK
--
Philip L. Karlton karlton@netscape.com
Principal Curmudgeon http://www.netscape.com/people/karlton
Netscape Communications Corporation
NODE 27443160Re: NIS library code exposure (Unix network exposure)
cort <cort@ecn.purdue.edu>Wed, 27 Sep 95 23:13:18 PDT
[....]
> Do you have any daemons that run as root and do networking? Are you
> sure that all of them check the length of the host name before passing
> it to gethostbyname?
[....]
On Linux:
ping [huge host name] works
ftp [huge host name] works
finger [huge host name] works
nslookup [huge host name] ... CRUNCH (Segmentation fault)
NODE a0631bc9Re: NIS library code exposure (Unix network exposure)
cort <cort@ecn.purdue.edu>Thu, 28 Sep 95 00:11:51 PDT
> [....]
>
> > Do you have any daemons that run as root and do networking? Are you
> > sure that all of them check the length of the host name before passing
> > it to gethostbyname?
>
> [....]
>
> On Linux:
> ping [huge host name] works
> ftp [huge host name] works
> finger [huge host name] works
> nslookup [huge host name] ... CRUNCH (Segmentation fault)
>
Ouch.....!
On Linux:
rsh [huge host name] crashes bad... (file system now corrupted)
The above claims for ping, ftp and finger may be dependent on how
huge is huge. rsh took a very large number (I'm guessing 10 lines,
800 characters) before crashing. Huge was not this huge for the
previous tests.
rsh is usually suid root.
I must quit experimenting now.... and repair my system.
Crypto relevance: little.... some hack relevance, lots of general
system/network security relevance
Cort.