SIG^2 Vulnerability Research Advisory
 
Orenosv HTTP/FTP Server Buffer Overflow Vulnerabilities
 
by Tan Chew Keong
Release Date: 08 May 2005
 
 
ADVISORY URL
http://www.security.org.sg/vuln/orenosv081.html
 
 
SUMMARY
 
Orenosv HTTP/FTP Server
(http://hp.vector.co.jp/authors/VA027031/orenosv/index_en.html) is a
stable, reliable and high performance HTTP/FTP/FTPS server that can
operate 24H/365D. Orenosp runs on Windows platforms (NT, 2000, XP and
2003) and Linux x86.
 
A remote buffer overflow vulnerability was found in Orenosv's FTP
server. This vulnerability may be exploited by a malicious user to crash
the server. A buffer overflow vulnerability also exists in the SSI
module of Orenosv's HTTP server. This overflow may be triggered using a
specially crafted SSI file (.shtml).
 
 
TESTED SYSTEM
 
Orenosv HTTP/FTP Server Version 0.8.1 on English Win2K SP4.
 
 
DETAILS
 
A remote buffer overflow vulnerability was found in Orenosv's FTP
server. This vulnerability may be exploited by a malicious user to crash
the server. A buffer overflow vulnerability also exists in the SSI
module of Orenosv's HTTP server. This overflow may be triggered using a
specially crafted SSI file (.shtml).
 
 
1. Multiple FTP Commands Buffer Overflow Vulnerability.
 
This buffer overflow is triggered when the server receives a FTP
file/directory manipulation command with a filename that is 249 or 250
bytes long. For 4-character FTP file/directory commands, 249-bytes
filenames will cause the overflow. Examples of 4-character FTP commands
include LIST, DELE, RETR etc.  For 3-character FTP commands, 250-bytes
filenames will cause the overflow. 3-character FTP commands include MKD,
RMD, CWD, etc.  The server restricts the maximum length of each input
line, hence using a filename that is longer than 250 will not trigger
the vulnerable function.
 
Reversing orenosv.exe shows that the problem lies in the unbounded copy
that occurs within the ftp_xlate_path(), ftp_is_canonial() and
os_fn_nativize() functions, as well as due to several unsafe use of
sprintf().
 
Exploitation is complicated by the fact that the buffer is limited to
250 bytes. Orenosv runs in two separate processes. (1) the monitoring
process, (2) the server process. The monitoring process will restart the
server process if it crashes due to the overflow.  On our test system,
we were able to cause a DoS on the server by sending the overflow buffer
in quick successions to the server. This causes both the server and
monitor process to crash, thus preventing any automatic restarts.
 
 
2. cgissi.exe Overly Long SSI Command Buffer Overflow Vulnerability.
 
Orenosv supports the use of SSI (.shtml). This supported is provided by
cgissi.exe. A buffer overflow vulnerability exists in cgissi.exe when
processing an overly long SSI command name.  The overflow occurs in the
parse_cmd() function. In this function, a loop performs an unsafe copy
of the SSI command name to a local stack buffer.  This copy loop is
terminated by the space character.  Exploitation may be limited since
the SSI command name is limited to less than 128 bytes.
 
 
PATCH
 
Upgrade to version 0.8.1a or later.
 
 
DISCLOSURE TIMELINE
 
26 Apr 05 - Vulnerability Discovered.
28 Apr 05 - Initial Author Notification.
29 Apr 05 - Initial Author Reply.
01 May 05 - Author Provided Fix for Testing.
01 May 05 - Informed Author that Overflow will still occur in
os_fn_nativize().
01 May 05 - Author Provided Another Fix for Testing.
01 May 05 - Informed Author that Overflow will still occur due to
several unsafe sprintf().
05 May 05 - Author Provided Another Fix for Testing.
05 May 05 - Informed Author of Potential Problem in STOU command.
06 May 05 - Author Provided Auother Fix for Testing.
07 May 05 - Author Released Patch.
08 May 05 - Public Release.
 
 
GREETINGS
 
All guys at SIG^2 G-TEC Lab
http://www.security.org.sg/webdocs/g-tec.html
 
"IT Security...the Gathering. By enthusiasts for enthusiasts."