CVE-2014-5439 - Root shell on Sniffit

Authors: Ismael Ripoll & Hector Marco
CVE:CVE-2014-5439
Dates:July 2014 - Discovered the vulnerability

Description

Sniffit is a packet sniffer and monitoring tool. A bug in sniffit prior to 0.3.7 has been found. The bug is caused by an incorrect implementation of the functions clean_filename() and clean_string() which causes a stack buffer overflow when parsing a configuration file with "long" paths (more than 20 characters).

The attacker can to create a specially-crafted sniffit configuration file, which is able to bypass all three protection mechanisms:

  1. Non-eXecutable bit NX
  2. Stack Smashing Protector SSP
  3. Address Space Layout Randomisation ASLR
And execute arbitrary code with root privileges (the id of the user that launches the sniffit).

The new issue has been assigned CVE-2014-5439.

The presented PoC successfully exploits the vulnerability.

Impact

To use the sniffit, the application need to be executed with root privileges. Typically by sudo or pkexec or setting the UID bit. Since this tool requires this privilege to execute the sniffer, only allowing to a user execute the sniffer is enough to execute commands as root.

Vulnerable packages

The sniffit 0.3.7 and prior are affected. Currently, this tool is in the universe repository installable via apt-get install sniffit. For example, the sniffit is available on Ubuntu 14.04.1 LTS and prior.

Vulnerability

The vulnerability is caused due to incorrect implementation of the functions clean_filename() and clean_string(). These functions suffer from a stack buffer overflow.

The bug appears in file sn_cfgfile.c on the following functions:

char *clean_string (char *string) {
   char help[20];
   int i, j;
   j=0;
   for (i=0;i<strlen(string);i++) {
      if( (isalnum(string[i]))||(string[i]=='.') ) {
         help[j]=string[i];
         help[j+1]=0;
      }
      j++;
   }
   strcpy(string, help);
   return string;
}

char *clean_filename (char *string) {
   char help[20];
   int i, j;
   j=0;
   for (i=0;i<strlen(string);i++) {
      if( !(iscntrl(string[i])) && !(isspace(string[i])) ) {
         help[j]=string[i];
         help[j+1]=0;
      }
      j++;
   }
   strcpy(string, help);
   return string;
}

Exploit (PoC)

I have built an exploit to bypass the three most popular protections techniques: Non-eXecutable bit NX, Stack Smashing Protector SSP and Address Space Layout Randomisation ASLR. The exploit finally obtains a root shell. The exploit was successfully tested with Ubuntu 14.04.1 LTS (trusty) with kernel 3.13.0-32-generic (x86_64) fully updated.

The sniffit exploit is a shell script which will creates a specially-crafted configuration file "exploit-sniffit-0.3.7-shell.cfg". Passing this configuration file to sniffit through the "-c" option we will obtain a root shell.

Obtaining a root shell:

$ id
uid=1000(box) gid=1000(box) groups=1000(box)
$ sniffit -c exploit-sniffit-shell.cfg
#
# id
uid=1000(box) gid=1000(box) euid=0(root) groups=1000(box)

FIX

The following is a simple patch which fixes the bug. Patch for sniffit 0.3.7:

diff -Nurp sniffit-0.3.7.beta/sn_cfgfile.c sniffit-0.3.7.beta-mod/sn_cfgfile.c
--- sniffit-0.3.7.beta/sn_cfgfile.c 2014-10-22 19:29:03.000000000 +0200
+++ sniffit-0.3.7.beta-mod/sn_cfgfile.c   2014-10-22 19:29:12.244971893 +0200
@@ -119,6 +119,11 @@ char *clean_string (char *string)
 char help[20];
 int i, j;
 
+if(strlen(string) >= 20){
+   fprintf(stderr, "Error: String too long [%s]\n", string);
+   exit(-1);
+}
+
 j=0;
 for(i=0;i<strlen(string);i++)
   {
@@ -138,6 +143,11 @@ char *clean_filename (char *string)
 char help[20];
 int i, j;
 
+if(strlen(string) >= 20){
+   fprintf(stderr, "Error: String too long [%s]\n", string);
+   exit(-1);
+}
+
 j=0;
 for(i=0;i<strlen(string);i++)
   {
[ sniffit-0.3.7-stack-buffer-overflow.patch ]

Patching sniffit 0.3.7:

$ wget http://hmarco.org/bugs/patches/sniffit-0.3.7-stack-buffer-overflow.patch
$ cd sniffit-0.3.7
$ patch -p1 < ../sniffit-0.3.7-stack-buffer-overflow.patch

Discussion

It is hard to understand why the sniffit is still under Ubuntu universe repository, which is easily installable via apt-get install sniffit. The functions clean_string and clean_filename contain two stack buffer overflows which allow to bypass the Stack Smashing Protector (SSP) very easy and build a sequence of ROP gadgets which finally obtains a root shell.

On the other hand, it seems that the code of sniffit is no longer maintained, and may contain additional security issues. Therefore, it is very recommend to not use the sniffit at all for the sake of your security.


Hector Marco - http://hmarco.org