Attachment 44578 Details for Bug 100428

mail as attachment

conntrack (text/plain), 7.63 KB, created by Ludwig Nussel on 2005-08-03 08:30:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-08-03 08:30:40 UTC

Size: 7.63 KB

patch

obsolete

>From vendor-sec-admin@lst.de  Wed Aug  3 09:54:17 2005
>Return-Path: <vendor-sec-admin@lst.de>
>X-Original-To: lnussel@wotan.suse.de
>Received: from Relay1.suse.de (relay1.suse.de [IPv6:2001:780:101:0:211:25ff:fe4a:6dba])
>	by wotan.suse.de (Postfix) with ESMTP id 6AB283A3BB4
>	for <lnussel@wotan.suse.de>; Wed,  3 Aug 2005 09:54:17 +0200 (CEST)
>Received: by Relay1.suse.de (Postfix)
>	id 5C98811285; Wed,  3 Aug 2005 09:54:17 +0200 (CEST)
>Received: from Relay1.suse.de (localhost [127.0.0.1])
>	by Relay1.suse.de (Postfix) with ESMTP id 438E611272;
>	Wed,  3 Aug 2005 09:54:17 +0200 (CEST)
>Received: from Relay1.suse.de ([127.0.0.1])
> by Relay1.suse.de (Relay1 [127.0.0.1]) (amavisd-new, port 10026) with ESMTP
> id 07389-16; Wed,  3 Aug 2005 09:54:15 +0200 (CEST)
>Received: from mx1.suse.de (ns.suse.de [195.135.220.2])
>	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
>	(No client certificate requested)
>	by Relay1.suse.de (Postfix) with ESMTP id F0B11C658;
>	Wed,  3 Aug 2005 09:54:14 +0200 (CEST)
>Received: from mail.lst.de (verein.lst.de [213.95.11.210])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by mx1.suse.de (Postfix) with ESMTP id D20D9E8D8;
>	Wed,  3 Aug 2005 09:54:14 +0200 (CEST)
>Received: from verein.lst.de (localhost [127.0.0.1])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j737rO6s020494;
>	Wed, 3 Aug 2005 09:53:24 +0200
>Received: from dhost002-41.dex002.intermedia.net (dhost002-41.dex002.intermedia.net [64.78.21.130])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j737qJ6s020468
>	for <vendor-sec@lst.de>; Wed, 3 Aug 2005 09:52:19 +0200
>Received: from misd002.dex002.intermedia.net ([64.78.61.100]) by dhost002-41.dex002.intermedia.net with Microsoft SMTPSVC(6.0.3790.1830);
>	 Wed, 3 Aug 2005 00:52:12 -0700
>Received: from [192.168.2.95] ([213.144.15.2]) by misd002.dex002.intermedia.net over TLS secured channel with Microsoft SMTPSVC(6.0.3790.1830);
>	 Wed, 3 Aug 2005 00:52:10 -0700
>Message-ID: <42F078A2.5060206@astaro.com>
>From: Stephan Scholz <sscholz@astaro.com>
>User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050513 Debian/1.7.8-1
>X-Accept-Language: de, de-de, en-us, en
>MIME-Version: 1.0
>To: vendor-sec@lst.de
>Cc: Markus Hennig <mhennig@astaro.com>,
>	Gert Hansen <ghansen@astaro.com>,
>	Holger Eitzenberger <heitzenberger@astaro.com>,
>	Harald Welte <laforge@gnumonks.org>
>Content-Type: text/plain; charset=us-ascii
>Content-Transfer-Encoding: 7bit
>X-OriginalArrivalTime: 03 Aug 2005 07:52:11.0217 (UTC) FILETIME=[4141A410:01C59800]
>Subject: [vendor-sec] Netfilter / PPTP conntrack helper kernel oops
>Sender: vendor-sec-admin@lst.de
>Errors-To: vendor-sec-admin@lst.de
>X-BeenThere: vendor-sec@lst.de
>X-Mailman-Version: 2.0.11
>Precedence: bulk
>List-Help: <mailto:vendor-sec-request@lst.de?subject=help>
>List-Post: <mailto:vendor-sec@lst.de>
>List-Subscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=subscribe>
>List-Id: <vendor-sec.lst.de>
>List-Unsubscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=unsubscribe>
>List-Archive: <https://www.lst.de/cgi-bin/mailman/private/vendor-sec/>
>X-Original-Date: Wed, 03 Aug 2005 09:56:18 +0200
>Date: Wed, 03 Aug 2005 09:56:18 +0200
>X-Virus-Scanned: by amavisd-new at Relay1.suse.de
>X-Spam-Status: No, hits=-1.0 tagged_above=-20.0 required=5.0 tests=BAYES_50,
> MY_LINUX
>X-Spam-Level: 
>Status: RO
>Content-Length: 4296
>Lines: 137
>
>Subject:
>
>  Netfilter / PPTP conntrack helper kernel oops
>
>Released:
>
>  03 August 2005
>
>Effects:
>
>  By creating several Call Requests within the same PPTP connection,
>  the PPTP conntrack helper ip_conntrack_pptp can lead to a kernel oops.
>  TCP port 1723 must be open either through or to the firewall,
>  and the ip_conntrack_pptp helper needs to be loaded.
>  Note that the PPTP conntrack helper is not part of the vanilla kernel
>  but available via netfilter patch-o-matic.
>
>  The error is in ip_conntrack_core.c in function ip_conntrack_expect_related()
>  and ip_conntrack_pptp.c in function exp_gre(). ip_conntrack_expect_related()
>  falsely returns an error, which causes the GRE conntrack entry to be freed.
>  This leads to a kernel oops. Even though the error is in ip_conntrack_core,
>  currently only the PPTP conntrack helper triggers this problem.
>
>  The vulnerability can be exploited by using the PPTP Bruter tool,
>  which is actually a password cracker against Microsoft PPTP servers
>  but which triggers this problem unintentionally. The kernel can be crashed
>  by using this tool either directly against the machine or against a machine behind it.
>  The tool can be retrieved from the following location:
>  http://www.thc.org/download.php?t=r&f=thc-pptp-bruter-0.1.4.tar.gz
>
>Estimated Severity:
>
>  High
>
>Systems Affected:
>
>  Linux kernels with ip_conntrack_pptp module loaded
>
>Solution:
>
>  1. Apply the patch below.
>
>  or
>
>  2. Remove the PPTP conntrack helper ip_conntrack_pptp kernel module
>
>Contact:
>  Harald Welte <laforge@gnumonks.org>
>  Stephan Scholz <sscholz@astaro.com>
>
>
>
>Patch for kernel 2.6
>--------------------
>
>
>Index: linux-2.6.10/net/ipv4/netfilter/ip_conntrack_core.c
>===================================================================
>--- linux-2.6.10.orig/net/ipv4/netfilter/ip_conntrack_core.c
>+++ linux-2.6.10/net/ipv4/netfilter/ip_conntrack_core.c
>@@ -1015,7 +1015,6 @@
>                                struct ip_conntrack *related_to)
> {
>        struct ip_conntrack_expect *old;
>-       int ret = 0;
>
>        WRITE_LOCK(&ip_conntrack_lock);
>        /* Because of the write lock, no reader can walk the lists,
>@@ -1090,7 +1089,6 @@
>                 * related_to->expecting.
>                 */
>                unexpect_related(old);
>-               ret = -EPERM;
>        } else if (LIST_FIND(&ip_conntrack_expect_list, expect_clash,
>                             struct ip_conntrack_expect *, &expect->tuple,
>                             &expect->mask)) {
>@@ -1107,7 +1105,7 @@
>
>        CONNTRACK_STAT_INC(expect_create);
>
>-       return ret;
>+       return 0;
> }
>
> /* Change tuple in an existing expectation */
>Index: linux-2.6.10/net/ipv4/netfilter/ip_conntrack_pptp.c
>===================================================================
>--- linux-2.6.10.orig/net/ipv4/netfilter/ip_conntrack_pptp.c
>+++ linux-2.6.10/net/ipv4/netfilter/ip_conntrack_pptp.c
>@@ -237,7 +237,6 @@
>
>                if (ip_conntrack_expect_related(exp, master) != 0) {
>                        ip_ct_gre_keymap_destroy(exp);
>-                       ip_conntrack_expect_put(exp);
>                        DEBUGP("cannot expect_related()\n");
>                        return 1;
>                }
>
>
>
>
>
>Patch for kernel 2.4
>--------------------
>
>
>--- linux-2.4/net/ipv4/netfilter/ip_conntrack_core.c
>+++ linux-2.4.conntrack_pptp/net/ipv4/netfilter/ip_conntrack_core.c
>@@ -939,7 +939,6 @@
>                                struct ip_conntrack_expect *expect)
> {
>        struct ip_conntrack_expect *old, *new;
>-       int ret = 0;
>
>        WRITE_LOCK(&ip_conntrack_lock);
>        /* Because of the write lock, no reader can walk the lists,
>@@ -1021,7 +1020,6 @@
>                 * related_to->expecting.
>                 */
>                unexpect_related(old);
>-               ret = -EPERM;
>        } else if (LIST_FIND(&ip_conntrack_expect_list, expect_clash,
>                             struct ip_conntrack_expect *, &expect->tuple,
>                             &expect->mask)) {
>@@ -1061,7 +1059,7 @@
>
>        WRITE_UNLOCK(&ip_conntrack_lock);
>
>-       return ret;
>+       return 0;
> }
>
> /* Change tuple in an existing expectation */
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>

Actions: View

Attachments on bug 100428: 44578 | 46143