Home page logo

bugtraq logo Bugtraq mailing list archives

[NetGuard Security] NSI Rwhoisd another Remote Format String Vulnerability
From: alert7 <alert7 () netguard com cn>
Date: Thu, 22 Nov 2001 10:22:4 +0800

        NSI Rwhoisd another Remote Format String Vulnerability

Release infomation

Release Date: 2001-11-22
Author:   By NetGuard Security Team 
          alert7 (alert7 () netguard com cn) 
Homepage: http://www.netguard.com.cn/


  Rwhoisd is a publicly available RWHOIS server daemon for Unix based 
systems developed and maintained by Network Solutions Inc. 

  Rwhoisd contains another remotely exploitable format string vulnerability. 
It is possible to overwrite memory by syslog() if set use-syslog: YES.
$ normal default is YES

Attackers may be able to execute arbitrary code on affected hosts.  


Version and Platform

Network Solutions rwhoisd 1.5
Network Solutions rwhoisd 1.5.1a
Network Solutions rwhoisd 1.5.2
Network Solutions rwhoisd 1.5.3
Network Solutions rwhoisd 1.5.5
Network Solutions rwhoisd 1.5.6
Network Solutions rwhoisd
Network Solutions rwhoisd 1.5.7
Network Solutions rwhoisd 1.5.7-1
Network Solutions rwhoisd


log() function will call syslog(syslog_level,message) if set use-syslog: YES 
in rwhoisd.conf file. Unfortunately,message is a user supplied format string.


[alert7 () redhat62 ]# telnet 0 4321
Connected to 0.
Escape character is '^]'.
%rwhois V-1.5:003fff:00 localhost.localdomain (by Network Solutions, Inc. V-1.5.7-1)
%p%p%p%p  <------input
%error 230 No Objects Found
Connection closed by foreign host.

[alert7 () redhat62 ]# tail /var/log/messages
Nov 21 13:04:06 redhat62 rwhoisd[27697]: CLIENT: query: 0xbffff8b00xbffff7fc0x808def80x806be4c
Nov 21 13:04:06 redhat62 rwhoisd[27697]: CLIENT: query response: 0 hits

Prove-Of-Concept exploit

wait for vendor fix it first ;)

Vendor information

Vendor was informed at 2001-11-21
Vendor Homepage: http://www.rwhois.net/ 

About Netguard

China Net Security Technology Corporation (CNTC) is a leading provider of comput
er network and information security services in China.

Copyright 2001 http://www.netguard.com.cn, All rights reserved.

  By Date           By Thread  

Current thread:
  • [NetGuard Security] NSI Rwhoisd another Remote Format String Vulnerability alert7 (Nov 23)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]