Subject: FWTK x-gw Security Advisory [GSA2000-01]

From: pre <[email-masked]>
Date: Thu, 26 Oct 2000 11:54:55 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

               geekgang Security Advisory [gsa2000-01]

                         [www.geekgang.co.uk]
                       © Copyright 2000 geekgang

ID:             geekgang GSA2000-01 01 v1.0
Topic:          FWTK x-gw format bug
Status:         Release 26th October, 2000
Author:         pre

Credit:         Pekka Savola found the potential problem in the code

[Abstract]
The x-gw (X Windows gateway) component of the TIS Firewall Toolkit
(FWTK) contains a format bug vulnerability that may be exploitable
within some installations, allowing users to execute arbitrary code.

[Description]
The FWTK contains a set of proxy applications that are designed to aid a

computing professional in building a firewall system. It is not a
complete firewall product within itself. As such it is impossible to
ascertain all the different configurations in which the various parts of

the FWTK have been installed.

The x-gw component is designed to proxy connections bewteen X Windows
clients and servers. It would normally be invoked via the tn-gw (Telnet
gateway) component of the FWTK. Installations using this tn-gw
invocation method of the x-gw are not vulnerable to this problem due to
pre-processing of input data that is performed by the tn-gw.
Installations using any other method to invoke the x-gw should check
their vulnerability status.

The x-gw takes the X Windows display to connect to as a command line
parameter or environment variable. It performs some sanity checking on
this input and reports an error if the checks fail. The function that
outputs the error message has a format bug, and uses the supplied
display string as part of the output.

The function at fault is pmsg() in the source file x-gw/pmsg.c

[Solution]
Patch:

--- x-gw/pmsg.c.orig Mon Oct 23 13:21:26 2000
+++ x-gw/pmsg.c Mon Oct 23 13:22:36 2000
@@ -37,9 +37,9 @@
   buf[sizeof(buf)-1] = '\0';
     }

-   if( uselog ) syslog( LLEV, buf );
+   if( uselog ) syslog( LLEV, "%s", buf );
     else {
-       fprintf( stderr, buf );
+       fprintf( stderr, "%s", buf );
         fflush(stderr);
     }
  }

[Exploit]
An exploit for this vulnerability will be made available on the geekgang

website.

[Disclaimer]
THE INFORMATION CONTAINED IN THIS ADVISORY IS BELIEVED TO BE ACCURATE ,
BUT NO REPRESENTATION OR WARRANTY IS GIVEN, EXPRESS OR IMPLIED, AS TO
ITS ACCURACY OR COMPLETENESS. NEITHER THE AUTHOR NOR THE PUBLISHER
ACCEPTS ANY LIABILITY WHATSOEVER FOR ANY DIRECT, INDIRECT OR
CONSEQUENTIAL LOSS OR DAMAGE ARISING IN ANY WAY FROM ANY USE OF, OR
RELIANCE PLACED ON, THIS INFORMATION FOR ANY PURPOSE. THIS ADVISORY MAY
BE REDISTRIBUTED PROVIDED THAT NO FEE IS ASSIGNED AND THAT THE ADVISORY
IS NOT MODIFIED IN ANY WAY.

---

From: Rick Murphy <[email-masked]>
Date: Thu, 26 Oct 2000 22:39:41 -0400

There's a short solution for this problem -
Don't allow anyone other than administrator to log in to your firewall 
directly.
Or, don't run x-gw setuid.

If either of the above is true, the bug can't be exploited. I'd like to 
think there's nobody out there running x-gw setuid root. (You're supposed 
to TURN OFF the setuid bits of unnecessary programs, not grant root 
permission to programs that don't need it.) However, if you're running that 
way, chmod 555 x-gw and you're safe.
What complicates this is that x-gw could possibly be set up by someone to 
run by a daemon or program that's setuid root and which fails to drop 
privileges before it forks x-gw.
The patch will be published on the www.fwtk.org web site for distribution. 
I'd be interested if anyone is actually vulnerable to this; send me private 
mail.
	-Rick

---

From: [email-masked]
Date: Fri, 27 Oct 2000 14:56:06 +0400

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

BTW mjr warned me that x-gw is potentially dangerous some years ago ;) 
a brief look at the code shows why - it is far from being as simple and elegant
as other fwtk components are.. but i had no time to examine it closer :( 

> I'd be interested if anyone is actually vulnerable to this; send me private 

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

From: pre <[email-masked]>
Date: Fri, 27 Oct 2000 08:25:19 +0100

> Or, don't run x-gw setuid.

Just to clarify this a bit. If you're doing either of the above you need your
head read. So, excluding the above, the problem scenario is:

o You're using x-gw with remote user access and invoking it with something
other than the tn-gw. This is gonna be a small number of people, but someone
out there will be doing it.

-pre

---

From: Moh Riky S <[email-masked]>
Date: Fri, 27 Oct 2000 08:04:28 +0700 (JAVT)

How i configure netacl to protect our server from telnet's service ?

any body help me, please !

---

From: Ted Keller <[email-masked]>
Date: Mon, 30 Oct 2000 17:40:20 -0500 (EST)

Moh Riky,

I assume  you want to permit certain hosts to telnet to the firewall while
preventing all other hosts from doing that.  

Check out question 2.9.2 on the  www.fwtk.org site.

ted keller