DOVES Vulnerability V-00112
DOVES Project
Computer Security Laboratory
Department of Computer Science
University of California at Davis
Brief summary: CGI phf program allows remote command execution through shell metacharacters.
Detailed description: The phf program, which is installed by default with several implementations of httpd servers, contains a weakness that can allow intruders to execute arbitrary commands on the server. The most common attack involves an attempt to retrieve the httpd server's /etc/passwd file. ~~~~~~ A security vulnerability has been reported in example CGI code, as provided with the NCSA httpd 1.5a-export and APACHE httpd 1.0.3 (and possibly previous distributions of both servers). The example code contains a library function escape_shell_cmd() (in cgi-src/util.c). This function, which attempts to prevent exploitation of shell-based library calls, such as system() and popen(), contains a vulnerability. Any program which relies on escape_shell_cmd() to prevent exploitation of shell-based library calls may be vulnerable to attack. In particular, this includes the "phf" program which is also distributed with the example code. Some sites may have installed phf by default, even though it is not required to run httpd successfully. Any vulnerable program which is installed as a CGI application may allow unauthorised activity on the HTTP server. A remote user may retrieve any world readable files, execute arbitrary commands and create files on the server with the privileges of the httpd process which answers HTTP requests. This may be used to compromise the http server and under certain configurations gain privileged access. The routine "escape_shell_cmd()" also occurs in the file "src/util.c". Note that the files "cgi- src/util.c" and "src/util.c" are not identical, however they both contain an identical copy of the routine "escape_shell_cmd()", which has the vulnerability. The file "src/util.c" is used to build the HTTP daemon, therefore the "newline" hole exists within the server. ~~~~~~
Components: Please note that this vulnerability is not in httpd itself, but in CGI programs which rely on the supplied escape_shell_cmd() function. Any HTTP server (not limited to NCSA or Apache) which has installed CGI programs which rely on escape_shell_cmd() may be vulnerable to attack.
Operating system(s): Apache Group Apache 1.0.3 NCSA NSCA httpd 1.5a-export
How to detect:
How to fix:
if(ind("&;`'\"|*?~^()[]{}$\\",cmd[x]) != -1){
Must be changed to:
if(ind("&;`'\"|*?~^()[]{}$\\\n",cmd[x]) != -1){
Other information:
PA Classification:
RISOS Classification:
Davis Classification:
Attacks: from Paul Danckaert pauld@lemur.org
----------------------------------------------------------------------
#!/usr/bin/perl
#
# Pseudo-Phf - A not-quite-real phf replacement that provides a warning
# against attacks, as well as presenting false
# information to the attacker.
#
# Paul Danckaert (pauld@lemur.org)
#
$email = "security@lemur.org";
$sendmail = "/usr/lib/sendmail";
###
print "Content-type: text/html\n\n";
if ($ENV{"QUERY_STRING"} eq "") {
do ShowForm();
$action = "Looked At Form";
} else {
if ($ENV{"QUERY_STRING"} =~ /(\/|%2f)passwd/i) {
do ShowBadPass();
$action = "Attempted Password Grab";
} else {
$action = "Submitted Form";
}
}
$notice = "[/CGI-BIN/PHF] $action";
open(MAIL,"| $sendmail $email");
print MAIL "From: PHF Watcher <$email>\n";
print MAIL "To: $email\n";
print MAIL "Subject: $notice\n\n";
print MAIL "[AutoMessage from PHF]\n\n";
print MAIL "ENV List\n------------------------------------------\n";
foreach $var (keys %ENV) {
$ENV{$var} =~ s/\n//g;
print MAIL "$var \t $ENV{$var}\n";
}
print MAIL ".\n\n";
close (MAIL);
#
# Print Error Message to the users request.
#
print <<"EOF";
Query Results
/usr/local/bin/ph - Command not found
EOF
exit 0;
sub ShowForm {
print <<"EOF";
Form for CSO PH query
Form for CSO PH query
This form will send a PH query to the specified ph server.
PH Server:At least one of these fields must be specified:Advisories: http://www.cert.org/summaries/CS-96.06.html http://www.cert.org/advisories/CA-96.06.cgi_example_code.html ERS-SVA-E01-1996:002.2: NCSA HTTPD and Apache HTTPD Common Gateway Interface vulnerability (IBM) ERS-SVA-E01-1996:002.1: CGI program can be tricked into executing any arbitrary command (IBM) CA-96.06: Vulnerability in NCSA/Apache CGI example code (CERT)
Related DOVES entries:
Who reported it: This bug was first made public by the IBM ERS Team. However, the bug was reported to them by Jennifer Myers early in 1996. Previous to that the exploit had been in wide distribution circles among hackers. Paul Danckaert, SecurityFocus message id Pine.SGI.3.95.960923104108.28911A- 100000@lemur.acs.umbc.edu in on from http://www.cert.org/advisories/CA-96.06.cgi_example_code.html The text of this advisory was originally released on March 14, 1996, as AUSCERT Advisory AA-96.01, developed by the Australian Computer Emergency Response Team. The actual release date of the IBM ERS Advisory (ERS-SVA-E01-1996:002.2) was 16 April 1996. Paul Danckaert's post: Mon Sep 23 1996 10:43:01
Send email to doves@cs.ucdavis.edu
Department of Computer Science
University of California at Davis
One Shields Ave.
Davis, CA 95616-8562
Dove images © 1999-2000 www.barrysclipart.com