NetBSD Problem Report #2456

From gnats  Wed May 22 06:13:08 1996
Received: from ns.southern.net by pain.lcs.mit.edu (8.7.4/8.6.12) with ESMTP id FAA02974 for <gnats-bugs@gnats.netbsd.org>; Wed, 22 May 1996 05:51:19 -0400 (EDT)
Message-Id: <199605220951.KAA03815@orwell.southern.net>
Date: Wed, 22 May 1996 10:51:16 +0100 (BST)
From: david@mono.org
Reply-To: david@mono.org
To: gnats-bugs@gnats.netbsd.org, misc@openbsd.org
Subject: (security) fingerd allows redirection
X-Send-Pr-Version: 3.95

>Number:         2456
>Category:       bin
>Synopsis:       (security) fingerd allows redirection
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    explorer
>State:          closed
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Wed May 22 06:20:10 +0000 1996
>Closed-Date:    Sat Aug 10 22:12:01 +0000 1996
>Last-Modified:  Sat Aug 10 22:15:06 +0000 1996
>Originator:     David Brownlee
>Release:        1.1B
>Organization:
Monochrome (http://www.mono.org)
>Environment:

System: NetBSD orwell.southern.net 1.1B NetBSD 1.1B (_SUN4C_) #0: Tue Apr 2 08:44:20 PST 1996 david@orwell.southern.net:/usr/src/sys/arch/sparc/compile/_SUN4C_ sparc


>Description:
	From a posting to BoS by Christopher Klaus <cklaus@iss.net>,
	regarding a potential Denial of Service attack, and 'machine hopping'
	using fingerd.

[start of text from Christopher Klaus <cklaus@iss.net>]
Finger Bomb - Some finger daemons allow redirecting the finger to remote sites.
To finger through several sites, finger username@hostA@hostB. The finger will
go through hostB then to hostA.  This helps hackers cover their tracks 
because HostA will see a finger coming from HostB instead of the original
service.  This technique has been used to go through firewalls themselves if
they are not properly configured.  This can happen by finger 
user@host@firewall.
A denial of service attack may happen when a person types:


         finger username@@@@@@@@@@@@@@@@@@@@@hostA

The @ repeated causes the finger to recursively finger the same machine
itself repeatedly till the memory and and hard drive swap space fills up and
causes the machine to crash or slow to unusable speeds.
[end of text from Christopher Klaus <cklaus@iss.net>]

>How-To-Repeat:
	finger root@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@localhost
	and watch your machine go away for a while.
>Fix:
	Fingerd should filter out loops to the current host.
	Ideally it should have a flag to either enable redirection
	(off by default) or to disable it.
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: explorer 
State-Changed-When: Sat Aug 10 18:12:01 EDT 1996 
State-Changed-Why:  
I updated fingerd.c to allow a command-line option to disable 
finger forwarding, and having more than one @ in a row will 
be stripped.  However, one attack, namely finger foo@localhost@localhost@localhost... 
will still work. 


Responsible-Changed-From-To: bin-bug-people->explorer 
Responsible-Changed-By: explorer 
Responsible-Changed-When: Sat Aug 10 18:12:01 EDT 1996 
Responsible-Changed-Why:  
I updated the sources, I'll keep this one. 
>Unformatted:

Home	PR Database Search