$_='print"\$_=\47$_\47;eval"';eval

If you enjoy self-generating, self-replicating or self-modifying code as much as me,
you can have a look here. The exponential more-perl engine is probably
never executed in the 5th generation, except you have plenty of RAM
and CPU power (e.g. you work for google:).
All samples you can download execute the same code at the end, even though
they need to un-nest and reorder the instructions until original code,
including comments, is reached.

IPv6 NAT

During my last ITO project I worked on a solution to implement some kind of NAT
for IPv6. Packet-mangling solutions such as netfilter are missing IPv6 NAT for a good
reason: One of IPv6' design goals was the end-to-end principle and NAT often puts
people in the wrong feeling of security. NAT is one major reason why VoIP-breakhrough
came so late.
However, transparent proxying and redirection of connections is also done via NAT,
and thats where NAT for IPv6 makes sense: to setup SPAM-traps, transparent
virii-scanning or HTTP proxies. My solution works on Linux kernels >= 2.6.14,
running as a normal user-space daemon.

Happy new 2009!

Recent 25c3 was a funny event, although I missed a couple of friends to talk to.

So, I could use some time-slots to talk to the OpenBSD folks about security,
which is always funny. Beside our differences about the meaning of exploitability,
they nevertheless do a good job and I highly respect their voluntary work, in
particular in a $$-driven (security-)world. Even on such event, about 2/3 of
the folks only talk about $$ and what kind of customer is waiting for new
'solutions'.
Thanks to the french telco guys for the free beer and the funny stories.

SSHv2 trickery

Current SSHv2 implementations suffer from a 'vulnerability' that allows traffic analysis
to match incoming and outgoing connections from a box. In case you use a SSH shell
on some box for anonymity before you SSH to some other box, a global observer
may correlate the traffic on the end-box and the box in between to find out
who actually connected to the end-box. Especially by observing packet sizes
and time differences of the connection, it is possible to see when something is typed
and what amount of output comes back. This works no matter of how many
hops are in between. It is then possible to finally find out the originating IP address.
SSHv2 specification was not really designed for anonymity or measures against
advanced traffic analysis, even if they have SSH_MSG_IGNORE packets.
I wrote a patch that adds constant delay and packet-size to the connection no matter
whether something is typed and how much is done one the connection.
You can find it here.

PAM spam

About PAM, the cool Pluggable Authentication Modules common across
all major Linux dists.

I recently was involved in a project that used PAM to authenticate users via some
special kind of hardware. A note to developers and reviewers: keep in mind
that pam_syslog() and pam_prompt() expect a format string as argument.
In case you write your own log-wrapping code which expects format strings itself,
you still need to pass resulting strings via the "%s" format specifier to these pam functions!
Keep in mind that attackers may pass
strings like "%%s%%n" to the first (correct) format-resolver which open a format string vulnerability
to following incorrect calls as it is shrinked to "%s%n".

Linus blogs!

It has been once more proved to me that blogs are, most of the time, not really
worth reading. Especially if they do not cover any technical or scientific details
(such as this posting :). Even more weird, a blog about family stuff and dogs
which is interesting like a XSS-attack inside cat. Really worth announcing it at heise news.
Apparently even more worth for people to reply with 100's of comments for such postings.

postfix trickery

Eventually, after years of research, I was able to add postfix
to my personal list of the exceptional exploited programs (exexpro) }|-)

As of now, updates are already available. CVE-2008-2936 and CVE-2008-2937
have been assigned to this issue. My dear colleague Thomas will have sent an advisory out today
(writing this one day before the CRD).
So far, my exexpro list has grown to contain the following (random order):
Postfix, rsync, traceroute, modprobe/kernel, vixie crontab, suidperl, sudo, lpr, cups,
ppp, ippp, LIDS, hylafax, racoon to just name the more popular ones. Some of them appear multiple
times, some of them only affected BSD systems. The OpenBSD team was so kind to
offer me a poster for a local root exploit in ppp years ago. Additionally,
dozens of less popular programs appear on the list such as
imwheel, kreatecd, dip, wmcdplay various other K* programs etc. For all of them I wrote an exploit.
I am not able to provide exploits anymore due to the new law about this in Germany.
The exceptional exploited also contains weak implementations of secure protocols (SSL, SSH)
or weak protocols itself (CHAP) or absolutely uncommon exploits (see last posting for instance).

Lets hope that I can continue the trickery list in future and let the targets be smart and
popular. Only the minority of issues have been overflow or related bugs, BTW.

I hope you enjoy non-XSS related issues :-)

OpenSolaris remote root exploit

Like the the BSI was new in the LiveCD market segment, so is Sun!

If you boot your OpenSolaris CD and have your network plugged in and a DHCP
server is available (very common setup today; every homeuser got DSL ...), remote
attackers can log into your machine with jack/jack and su to root with
opensolaris. What a luck that remote root logins are disabled by the sshd running
during the installation procedure. It also has a nice banner which distinguishs it
clearly from the rest of the OpenSSH world.
Far more bad than the BOSS BSI issue:
If you want to install OpenSolaris (and a plenty of sysadmins will do) the only
way is to boot the LiveCD and install it from there. You are owned before your installation procedure is finished!

So, somehow, we got a remote root exploit for a lot of data centers I guess. And BTW,
if there is no DHCP server running at the university, attackers can feel free to setup one :-)

Beside that, I like the Open Source path which Sun is now walking on and Solaris
is still a very cute OS which kicks ass. But admins should really unplug
the network cable during installation. No kidding. If I got something wrong, feel
free to mail me and I will correct myself. I tested the 2008.05 image from their main download
site.

Update: Sun Microsystems is already tracking this issue and will change the behavior with
the next live CD release.

I notify ...

I wonder it took so long to discover that DNS is vulnerable to a birthday attack :-)
A 16 bit ID in the DNS header never added any security and I doubt that source port randomization will.

Anyway... While I was hunting down some race conditions recently I remembered the
new inotify(2) system calls in recent Linux 2.6 kernels. Some of you might not be aware of
this, but this is an excellent way to win races. Beside that you can re-write tmp-watch to work
really reliable. While up-to-then tools (including my own) needed to rescan directories to find out changes
which was prone to error and racy in itself, you can now watch the lifetime of a file from creation,
during chmod until closing. The short screenshot shows the basics.
You can download the small helper program here.
It is very interesting to watch mail and print spoolers using this program! :-)
If you find any exploitable tmp-races using my program, feel free to credit and inotify me :-)

rsync xattr item_list heap overflow

Last week I discovered a classical integer wrap around which leads to a heap
overflow in rsync 3.0. A source patch can be found here.
We backported the xattr feature to some of our 2.6.9 and 2.6.8 versions.
Even though the code base is different there, the vulnerability also exists.
Updated packages will soon be available.