Bugzilla Bug 113888

Possible webmin issue: 
 
SUMMARY. The webmin `miniserv.pl' web server component is vulnerable to  
 a new class of exploitable (remote code) perl format string  
 vulnerabilities. During the login process it is possible to trigger this  
 vulnerability via a crafted username parameter containing format string  
 data. In the observed configuration the process was running as the user  
 root, so so if remote code execution is successful, it would lead to a  
 full remote root compromise in a standard configuration. A valid login  
 is not required to trigger this vulnerability, only access to the  
 miniserv.pl port (default 10000).  
  
Date Found: September 23, 2005.  
 Public Release: November 29, 2005.  
 Application: webmin miniserv.pl, all known versions  
 Credit: Jack Louis of Dyad Security  
  
BACKGROUND. miniserv.pl is a part of the webmin system administration  
 front end, written in perl by Jamie Cameron. more details are available  
 at http://www.webmin.com.  
  
DESCRIPTION. The username parameter of the login form is logged via the  
 perl `syslog' facility in an unsafe manner during a unknown user login  
 attempt. the perl syslog facility passes the username on to the variable  
 argument function sprintf that will treat any format specifiers and  
 process them accordingly.  
  
DETAILS. The vectors for a simple DoS of the web server are to use the  
 %n and %0(large number)d inside of the username parameter, with the  
 former causing a write protection fault within perl leading to script  
 abortion, and the latter causing a large amount of memory to be  
 allocated inside of the perl process.  
  
A generic remote code execution exploit method has been developed by a  
 third party that is reachable though this hole itself.  
  
The following is the section of code in question. (from miniserv.pl)  
  
if ($use_syslog && !$validated) {  
         syslog("crit",  
                ($nonexist ? "Non-existent" :  
                 $expired ? "Expired" : "Invalid").  
                " login as $authuser from $acpthost");  
         }  
  
As can be clearly seen with this section of code, the user supplied data  
 is clearly within the format specification of the syslog call.  
  
Additional information and sample work around patches can be found at  
 http://www.dyadsecurity.com/webmin-0001.html

eradicator, please bump with appropriate format string patches.

Apparently this is under discussion on FD, we should probably first reproduce
rather than blindly patching :

"Sys::Syslog calls sprintf($format, @_). I tried testing this on perl 5.8.7 
and don't see how this can be exploitable.  The %n specifier results in 
the following error message:

$ perl -e 'sprintf("%n")'
Modification of a read-only value attempted at -e line 1.

Using a thousand %p's results in the same address (presumably of the 
temporary char *) over and over again

It is possible to memory starve webmin with a long %9999999999d string, 
but arbitrary memory writes seem to be out of the question.

What version of perl was used by the third-party to exploit this?"

The following versions contain the fix:
usermin 1.180
webmin 1.250

Need keywording:

alpha - webmin, usermin
hppa - webmin, usermin
mips - webmin (for about 3 exploits)
ppc - webmin, usermin
ppc64 - webmin, usermin
s390 - webmin
sh - webmin

Looks like you need a very specific/old/borked version of Perl for this to
work... not even sure it's possible to find an affecetd one with Gentoo.
 
eradicator: did you reproduce the thing ?

No, I didn't try reproducing the exploit on my box.  I just bumped the versions
in portage and tested them to work properly.

OK, this is confirmed. Arches please test and mark stable accordingly.

Note: this should probably be fixed Perl-wide through bug 114113...

stable on ppc64 

Stable on alpha

Marked ppc stable.

hppa done.

GLSA 200512-02 
 
arm, mips, s390 don't forget to mark stable to benifit from the GLSA. 

http://use.perl.org/article.pl?sid=05/12/13/1258222 - Sys::Syslog patch/update
is available that would also fix this (since that's the module that exposes *min
to the bug as I understand it). Just adding in case its worthy,

~mcummings