[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+5g0SK70uFgQHTPv03nk7kpJmH855+GdPRoE+Xvosz6NiG=6A@mail.gmail.com>
Date: Fri, 14 Jun 2013 15:40:54 -0300
From: Felipe Pena <felipensp@...il.com>
To: "Christey, Steven M." <coley@...re.org>
Cc: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: CVE request: FD leakage for cgi program on Monkey HTTPD
Hi,
2013/6/14 Christey, Steven M. <coley@...re.org>:
> Felipe,
>
> Sorry if this is a dumb question.
>
> If you are using "file descriptor leak" in the sense of "malicious parties can directly access the file descriptor" - then that doesn't seem to be the case here, because permissions are limited only to you.
>
> If you are using "file descriptor leak" in the sense of "the program does not close a file after opening it, consuming too many file descriptors," then how can a program take control of Monkey HTTPD?
>
> - Steve
>
>
Actually the server is running using my user, because this you see my
name as user there.
I just did a test running the server as root, it used the user in the
configuration file, but the cgi program still using the same user than
the server.
On my PoC (which uses leaked networkd socket fd to accepts connections
and write to them) I just was able to write the response to the next
requests instead of the HTTPD server.
>>-----Original Message-----
>>From: Felipe Pena [mailto:felipensp@...il.com]
>>Sent: Friday, June 14, 2013 1:24 PM
>>To: oss-security@...ts.openwall.com
>>Subject: [oss-security] CVE request: FD leakage for cgi program on Monkey
>>HTTPD
>>
>>I've identified a fd leakage when running a program via Monkey HTTPD -
>>CGI plugin.
>>
>>By runninng `ls -lah /proc/<pid>/fd/` on the CGI program we can see:
>>
>>total 0
>>dr-x------ 2 felipe felipe 0 Jun 14 14:00 .
>>dr-xr-xr-x 8 felipe felipe 0 Jun 14 14:00 ..
>>lr-x------ 1 felipe felipe 64 Jun 14 14:00 0 -> pipe:[239545]
>>l-wx------ 1 felipe felipe 64 Jun 14 14:00 1 -> pipe:[239546]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 10 -> anon_inode:[eventpoll]
>>lr-x------ 1 felipe felipe 64 Jun 14 14:00 11 -> pipe:[242960]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 12 -> anon_inode:[eventpoll]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 13 -> anon_inode:[eventpoll]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 14 -> anon_inode:[eventpoll]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 15 -> anon_inode:[eventpoll]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 16 -> anon_inode:[eventpoll]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 17 -> anon_inode:[eventpoll]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 18 -> anon_inode:[eventpoll]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 19 -> anon_inode:[eventpoll]
>>l-wx------ 1 felipe felipe 64 Jun 14 14:00 2 -> /dev/null
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 3 -> socket:[240797]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 4 ->
>>/home/felipe/audit/monkey/monkey/logs/monkey.pid.2001
>>lr-x------ 1 felipe felipe 64 Jun 14 14:00 5 -> pipe:[240798]
>>l-wx------ 1 felipe felipe 64 Jun 14 14:00 6 -> pipe:[240798]
>>lr-x------ 1 felipe felipe 64 Jun 14 14:00 7 -> pipe:[240799]
>>l-wx------ 1 felipe felipe 64 Jun 14 14:00 8 -> pipe:[240799]
>>lrwx------ 1 felipe felipe 64 Jun 14 14:00 9 -> socket:[242784]
>>
>>Hence a malicious program can take control of Monkey HTTP request response
>>through a network socket related file descriptor, etc.
>>
>>
>>Report
>>------
>>http://bugs.monkey-project.com/ticket/187
>>
>>
>>CREDITS
>>-------
>>Felipe Pena
>>
>>--
>>Regards,
>>Felipe Pena
--
Regards,
Felipe Pena
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
