> Search

Advisory follows

Openswan XAUTH/PAM Buffer Overflow Vulnerability

Published:: 2005-01-26
Revision of advisory:: 2005-01-26 1.0 Initial Release
Location:: http://www.idefense.com/application/poi/display?id=190; http://www.openswan.org/support/vuln/can-2004-0590
CVE:: CAN-2005-0162

The discoverer of this vulnerability wishes to remain anonymous. iDEFENSE reported the vulnerability to Xelerance.

No exploit is known to be available.

Affected system(s)

KNOWN VULNERABLE: Systems running any version of Openswan prior to 1.0.9, 2.2.1 or 2.3.0, that have XAUTH + PAM enabled. Note that both are disabled by default, and require changes in Makefile/Makefile.inc to be enabled.

openswan 1.x < 1.0.9
openswan 2.x < 2.2.1
openswan 2.x < 2.3.0

DESCRIPTION

Remote exploitation of a stack based buffer overflow vulnerability in
Xelerance Corp.'s Openswan could allow attackers to execute arbitrary
code.

The vulnerability specifically exists due to a lack of bounds checking
in the pluto application when Openswan is compiled with XAUTH and PAM
support. The get_internal_addresses() function in
programs/pluto/xauth.c allocates a small character array and copies an
overly long user controlled buffer into the array as seen below. The
resulting stack overflow may be leveraged to execute arbitrary code
with permissions of the pluto process.

programs/pluto/id.h:

47:  #define IDTOA_BUF 512
programs/pluto/xauth.c:
148: #ifdef XAUTH_USEPAM
149: int retval;
150: char str[48];
151: #endif
...
169: if(retval == PAM_SUCCESS)
170: {
171:  char buf[IDTOA_BUF];
...
185:  sprintf(str,"ID=%s", buf);

ANALYSIS

Successful exploitation of the vulnerability can allow remote attackers
to execute code with privileges of the pluto process. Exploitation in
the wild will be limited due to the fact that Openswan would need to be
compiled with XAUTH and PAM options enabled which are both disabled by
default. In addition, exploitation occurs after an IKE Phase-1 Security
Association (SA) has been established which requires authentication of
a shared key and the supplied client certificate, further reducing the
impact of this vulnerability.

DETECTION

iDEFENSE has confirmed that Openswan 2.2.0 is vulnerable. All previous versions of Openswan also contain the vulnerable code.

WORKAROUND

The XAUTH and PAM configuration options can be found in Makefile.inc in
the Openswan source tree. Disable both configuration options if they are enabled, or apply the following vendor-supplied patch:

Index:
xauth.c
===================================================================
RCS
file:
/xelerance/master/openswan-2/programs/pluto/xauth.c,v
retrieving
revision 1.35
diff -u -p -u -r1.35 xauth.c
- --- xauth.c 30
Nov 2004 15:30:24 -0000 1.35
+++ xauth.c 8 Jan 2005
02:25:35 -0000
@@ -187,7 +187,7 @@ int get_internal_addresses(struct
connec  {  
 #ifdef
XAUTH_USEPAM
     int retval;
-
-    char str[48];
+    char
str[IDTOA_BUF+sizeof("ID=")+2];
 #endif

 #ifdef NAT_TRAVERSAL /* only NAT-T code lets us do virtual ends
*/ 
@@ -222,7 +222,7 @@ int get_internal_addresses(struct
connec
         
memmove(buf, c1+3,
strlen(c1) + 1 -
3);
        
}
        }
-
-       sprintf(str,"ID=%s",
buf);
+       snprintf(str,
sizeof(str), "ID=%s",
buf);
       
pam_putenv(con->pamh,str);
       
pam_open_session(con->pamh,0);
      
}

DISCLOSURE TIMELINE

01/06/2005 Initial vendor notification
01/06/2005 Initial vendor response
01/26/2005 Public disclosure

   Xelerance Corporation
   Email:  vuln@xelerance.com
   Web:    http://www.xelerance.com/
   Phone:  +1 905 257 3392

publically disclosed vulnerabilities