Www.edup.tudelft.nl/~bjwever/advisory setiathome.html.php

From Skypher

Information leakage and remotely exploitable buffer overflow in various SETI@home clients and the main server.

Background information

From http://setiathome.berkeley.edu/ :

"SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data."

"The SETI@home program is a special kind of screensaver. Like other screensavers it starts up when you leave your computer unattended, and it shuts down as soon as you return to work. What it does in the interim is unique. While you are getting coffee, or having lunch or sleeping, your computer will be helping the Search for Extraterrestrial Intelligence by analyzing data specially captured by the world's largest radio telescope. "

"The client/screensaver is available for download only from this web page - we do not support SETI@home software obtained elsewhere. This software will upload and download data only from our data server here at Berkeley. The data server doesn't download any executable code to your computer. All in all, the screensaver is much safer than the browser you're running right now!"

There were over four million registered users of seti@home at the time of this writing. Over half a million of these users are "active"; they have returned at least one result within the last four weeks.

The vulnerabilities

The seti@home clients use the HTTP protocol to download new workunits, user information and to register new users. The implementation has these security vulnerabilities:

1. All information is send in plaintext across the network. This information includes the processor type and the operating system of the machine seti@home is running on.
2. There is a bufferoverflow in the server responds handler. Sending an overly large string followed by a newline (' ') character to the client will trigger this overflow. This has been tested with various versions of the client. All versions are presumed to have this flaw in some form.
3. A similar buffer overflow seems to affect the main seti@home server at shserver2.ssl.berkeley.edu. It closes the connection after receiving a too large string of bytes followed by a ' '.

Affected versions

Confirmed information leaking:

• This issue affects all clients.

Confirmed remote exploitable:

• setiathome-3.03.i386-pc-linux-gnu-gnulibc2.1
• setiathome-3.03.i686-pc-linux-gnu-gnulibc2.1
• setiathome-3.03.i386-pc-linux-gnulibc1-static
• setiathome-3.03.i686-pc-linux-gnulibc1-static
• setiathome-3.03.i386-winnt-cmdline.exe
• i386-unknown-freebsd2.2.8 (Special thanks to Niels Heinen)
• SETI@home.exe (v3.07 Screensaver)

Confirmed DoS-able using buffer overflow:

• The main seti@home server at shserver2.ssl.berkeley.edu

Exploit

exploits/spaceInvaders.tbz2 contains C source-code for the actual BoF exploit.

Sniffing the information exposed by the seti@home client is trivial and very usefull to a malicious person planning an attack on a network. A passive scan of machines on a network can be made using any packetsniffer to grab the information from the network.

All tested clients have similar buffer overflows, which allowed setting eip to an arbitrairy value which can lead to arbitrairy code execution. An attacker would have to reroute the connection the client tries to make to the seti@home webserver to a machine he or she controls. This can be done using various widely available spoofing tools. Seti@home also has the ability to use a HTTP-proxy, an attacker could also use the machine the PROXY runs on as a base for this attack. Routers can also be used as a base for this attack.

Exploitation of the bug in the server has offcourse not been tested. Do understand that successfull exploitation of the bug in the server would offer a platform from which ALL seti@home clients can be exploited.

Timeline

Patch

Can be found at The SETI@HOME homepage.

Links

• SpaceInvaders.tbz2: SETI@home workunit BoF remote compromise exploit.
• CERT: SETI@home client vulnerable to buffer overflow.
• Secunia: SETI@home remotely exploitable buffer overflow.
• ZDNet news: SETI@home flaw could let invaders in.
• New Scientist: Flaw opens alien program to invaders.
• SETI@home: Changes in Version 3.08 of SETI@home.