Assignment 8. Buffer overruns

Useful pointers

• Elias Levy a.k.a. Aleph One, Smashing the stack for Fun and Profit, Phrack 7, 49 (1996-11-08), file 14.
• David Wheeler, Secure Programming for Linux and Unix HOWTO—Creating Secure Software (2011-02-09).
• Julian Seward et al., Valgrind Quick Start Guide (2012-08-10)
• Julian Seward et al., Valgrind User Manual (2012-08-10)
• Ken Thompson, Reflections on Trusting Trust, Communications of the ACM 27, 8 (1984-08), 761-763.
• CERT Coordination Center

Laboratory: Exploiting a buffer overrun

As usual, keep a log in the file lab.txt of what you do in the lab so that you can reproduce the results later. This should not merely be a transcript of what you typed: it should be more like a true lab notebook, in which you briefly note down what you did and what happened.

For this laboratory, you will find and exploit a simple buffer overrun in a web server.

Consider the following patch to sthttpd. This patch applies to sthttpd 2.26.4.

diff -pru sthttpd-2.26.4/src/thttpd.c sthttpd-2.26.4-new/src/thttpd.c
--- sthttpd-2.26.4/src/thttpd.c	2012-07-13 04:32:59.000000000 -0700
+++ sthttpd-2.26.4-new/src/thttpd.c	2012-11-18 22:11:39.275115033 -0800
@@ -1600,7 +1600,7 @@ handle_read( connecttab* c, struct timev
     /* Read some more bytes. */
     sz = read(
 	hc->conn_fd, &(hc->read_buf[hc->read_idx]),
-	hc->read_size - hc->read_idx );
+	hc->read_size );
     if ( sz == 0 )
 	{
 	httpd_send_err( hc, 400, httpd_err400title, "", httpd_err400form, "" );

1. Build sthttpd with this patch applied, and run the modified thttpd daemon on port 8080 on your host. You may find the thttpd man page useful.
2. Verify that your web server works in the normal case.
3. Make your web server crash by sending it a suitably-formatted request.
4. Run your web server under GDB, and get a traceback immediately after the crash.
5. Briefly describe how you'd go about building a remote exploit for the bug in the modified thttpd. Your exploit should allow you to run arbitrary code on the web server, with the same privileges as the web server itself.
6. Use GCC's -S option to generate the assembly language code for thttpd.c twice, once with GCC's -fstack-protector option, and once with its -fno-stack-protector option. Call the resulting files thttpd-stackprot.s and thttpd-nostackprot.s. Use diff to compare the two assembly-language files. Which code looks less efficient, and why? Write a simple shell command that invokes diff and determines which functions are called (in the sense of the machine-language call instruction) by one version and not the other, and use the command to see what functions these are.
7. Try running your web server under valgrind; what does it do?
8. There's another way to catch errors like this, which is to enable GCC's -fsanitize=address option. Build the patched thttpd with -fsanitize=address -fstack-protector, run it under GDB, send it a suitably-formatted request, and see what the traceback looks like. Note that -fsanitize=address requires the use of the linker option -Xlinker --rpath=... as illustrated below. Do your experiment on the SEASnet GNU/Linux servers: Use the port number specified by your T.A. (which is probably not port 8080), and compile in 32-bit mode using the CS version of GCC, with something like the following shell command:

   make CC="gcc -m32" \
     CFLAGS="-fsanitize=address -fstack-protector" \
     LDFLAGS="-Xlinker --rpath=/usr/local/cs/gcc-$(gcc -dumpversion)/lib"
   

9. Use GCC's -S option to generate the assembly language code for thttpd.c, with the -fsanitize=address -fstack-protector option. Call the resulting file thttpd-sanitize.s. Use diff to compare it to thttpd-stackprot.s. Which code looks less efficient, and why?

Homework: CERT review

Suppose you have built and deployed a networked application from standard software components and are now worried that the application might be vulnerable to outside attackers via the Internet.

Assume that each of the following CERT Vulnerability Notes describes a component of your system. Rank the seriousness of each vulnerability, so that the most urgent vulnerability is listed first. (By "urgent" we mean "urgent that you stay up all night if necessary and fix this right away in your deployed system".) Justify your rankings by evaluating the plausibility of attack scenarios.

• VU#774103 (2013-05-17) Linux kernel perf_swevent_enabled array out-of-bound access privilege escalation vulnerability
• VU#127108 (2013-05-14) Serva32 2.1.0 TFTPD service buffer overflow vulnerability
• VU#237655 (2013-05-06) Microsoft Internet Explorer 8 CGenericElement object use-after-free vulnerability
• VU#912420 (2013-04-30) IBM Notes runs arbitrary JAVA and Javascript in emails
• VU#945216 (2001-10-24) SSH CRC32 attack detection code contains remote integer overflow

Submit

Submit the following files.

• The files lab.txt and thttpd-sanitize.s as described in the lab.
• A file hw.txt containing your answer to the homework.

All files should be ASCII text files, with no carriage returns, and with no more than 200 columns per line. The shell command

expand lab.txt hw.txt |
  awk '/\r/ || 200 < length'

should output nothing.