SecurityReason - SmbClientParser Perl module allows remote command execution

Advisory Text :

=============================================
INTERNET SECURITY AUDITORS ALERT 2006-006
- Original release date: February 28, 2006
- Last revised: July 18th, 2008
- Discovered by: Jesus Olmos Gonzalez
- Severity: 5/5
=============================================

I. VULNERABILITY
-------------------------
SmbClientParser perl module allows remote command execution.

II. BACKGROUND
-------------------------
SmbClientParser is a useful perl module to writing Netbios interactive
codes, is a wraper from linux smbclient command and can be downloaded
from:
http://search.cpan.org/~alian/Filesys-SmbClientParser-2.7/SmbClientParse
r.pm

or installed:
perl -MCPAN -e shell
install Filesys::SmbClientParser

III. DESCRIPTION
-------------------------
If a host scans your shared folder whith a tool that uses this module,
you can execute shell commands in his host.

This module has the following snippet of code:

my @var = `$pargs`;

pargs it is parsed with the following poor filters:

my $pargs;
if ($args=~/^([^;]*)$/) { # no ';' nickel
$pargs=$1;
} elsif ($smbscript) { # ';' is allowed inside -c ' '
if ($args=~/^([^;]* -c '[^']*'[^;]*)$/) {
$pargs=$1;
} else { # what that ?
die("Why a ';' here ? => $args");
}
} else { die("Why a ';' here ? => $args"); }

If thereis a folder inside a shared folder with the following name:

' x && xterm &#

The perl will spawn an xterm :)
Note that this was reported at 2006 and no answer received, be
carefoul with cpan modules.

IV. PROOF OF CONCEPT
-------------------------
This folder name inside the shared folder:

' x && xterm &#

Will execute the following:
/usr/bin/smbclient "//x.x.x.x/vulns" -U "user%pass" -d0 -c 'cd "'
x && xterm &#"' -D "/poc"

This proof of concept spawns a xterm at vyctims xwindow, replace xterm
for the evilcommands.

V. BUSINESS IMPACT
-------------------------
-

VI. SYSTEMS AFFECTED
-------------------------
Versions up to 2.7 included (all)

VII. SOLUTION
-------------------------
Use this patch:

138a139,146
>
#-----------------------------------------------------------------------
-------
> # Sanitize (jolmos[@]isecauditors[.]com)
>
#-----------------------------------------------------------------------
-------
> sub Sanitize {
> my $danger = $_[0]; #There are many danger bytes,
but if the
> $$danger =~ s/\n|\r|'|"|//ig; #danger string is inside ""
or '' the only
> #option is break with ' or "
or \r or \n
> }
265a274
> foreach my $i (@_) { &Sanitize(\$i); }
287a297
> foreach my $i (@_) { &Sanitize(\$i); }
321a332
> foreach my $i (@_) { &Sanitize(\$i); }
331a343
> foreach my $i (@_) { &Sanitize(\$i); }
345a358
> foreach my $i (@_) { &Sanitize(\$i); }
359a373
> foreach my $i (@_) { &Sanitize(\$i); }
373a388
> foreach my $i (@_) { &Sanitize(\$i); }
375a391
>
387a404
> foreach my $i (@_) { &Sanitize(\$i); }
398a416
> foreach my $i (@_) { &Sanitize(\$i); }
409a428
> foreach my $i (@_) { &Sanitize(\$i); }
487a507
> foreach my $i (@_) { &Sanitize(\$i); }

VIII. REFERENCES
-------------------------
http://search.cpan.org/~alian/Filesys-SmbClientParser-2.7/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported by Jesus Olmos
Gonzalez (jolmos (at) isecauditors (dot) com).

X. REVISION HISTORY
-------------------------
April 26, 2006: Initial release.
July 14, 2008: Patch added.
July 18, 2008: Published.

XI. DISCLOSURE TIMELINE
-------------------------
February 26, 2006: The vulnerability discovered by
Internet Security Auditors.
April 26, 2006: Initial vendor notification sent.
September 14, 2006: Second notification: correction in one week.
No correction.
December 2, 2006: Third notification: no response.
January 18, 2007: Forth notification: no response.
May 1, 2007: Fifth notification: no response.
November 11, 2007: Sixth notification: no response.
July 14, 2008: Seventh notification: no response from the
developer (Alain Barbet), we wrote the patch.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Internet Security Auditors accepts no responsibility for any damage
caused by the use or misuse of this information.