Title: GNU CFEngine AuthenticationDialogue Remote Heap Based Buffer Overrun Vulnerability
Severity: CRITICAL
Description:
GNU cfengine is software for automating administration and maintenance of large networks. It is available for Unix and Linux variants.
GNU cfengine cfservd is reported prone to a remote heap-based buffer overrun vulnerability. The vulnerability presents itself in the cfengine cfservd AuthenticationDialogue() function that is responsible for processing SAUTH commands and also performing RSA based authentication.
The issue exists due to a lack of sufficient boundary checks performed on challenge data that is received from a client. Specifically, crypt_len, nonce_len and iscrypt values are received from the client. A check is performed on crypt_len and nonce_len length values to ensure that they are not zero; the value crypt_len is then used to allocate a buffer on the heap as follows:
decrypted_nonce = malloc(crypt_len)
An attacker may use this functionality to create a heap-based buffer of an attacker specified size.
Next the iscrypt value is checked, if this value is not 'y', then "nonce_len" bytes of data, which is an attacker controlled value, will be copied from the client challenge data into the buffer that was allocated previously in the heap (decrypted_nonce) as follows:
memcpy(decrypted_nonce,recvbuffer+CF_RSA_PROTO_OFFSET,nonce_len)
Because the size of the buffer, the size of data copied in the memcpy() operation, and the data copied are all controlled by the attacker, a remote attacker may likely exploit this condition to corrupt in-line heap based memory management data. Ultimately an attack may result in the execution flow of the vulnerable service being controlled, leading to execution of attacker supplied arbitrary instructions/code.
cfservd employs an IP based access control method (AllowConnectionsFrom). This access control must be bypassed prior to exploitation. This may hinder exploitation attempts.
This vulnerability is reported to affect versions 2.0.0 to 2.1.7p1 of cfengine cfservd.
Affected Products:
- GNU Cfengine 2.0.0.0
- GNU Cfengine 2.0.0.8
- GNU Cfengine 2.0.0.8p1
- GNU Cfengine 2.0.1
- GNU Cfengine 2.0.2
- GNU Cfengine 2.0.3
- GNU Cfengine 2.0.4
- GNU Cfengine 2.0.5
- GNU Cfengine 2.0.5b1
- GNU Cfengine 2.0.5pre
- GNU Cfengine 2.0.5pre2
- GNU Cfengine 2.0.6
- GNU Cfengine 2.0.7
- GNU Cfengine 2.0.7p1
- GNU Cfengine 2.0.7p2
- GNU Cfengine 2.0.7p3
- GNU Cfengine 2.1.0.0a6
- GNU Cfengine 2.1.0.0a8
- GNU Cfengine 2.1.0.0a9
- GNU Cfengine 2.1.7p1
References:
- Cfengine: Cfengine Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
