Re: Bearerbox Panic after receiving CIFS/SMB request at smsbox-port

[Alexander Malysh]

Hi,

thanks for report. I just fixed this issue in cvs. Please retest.

Thanks,
Alexander Malysh

Am 18.09.2009 um 17:00 schrieb Michael Zervakis:

Dear all,

During testing of Bearerbox using version cvs-20090506 I found that if smsbox socket receives a CIFS/SMB request bearerbox panics. This means that a malicious user could easily crash bearerbox simply by scanning the host (for example via nmap -sV).

2009-09-18 17:09:18 [2002] [5] DEBUG: Started thread 30 (gw/ bb_boxc.c:function) 2009-09-18 17:09:18 [2002] [30] PANIC: Internal error: unknown message type: -11317950 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox(gw_panic+0xbc) [0x80d8fcc] 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox(msg_unpack_real +0x78) [0x8065c88]

2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox [0x8057e50]
2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox [0x80596b9]
2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox [0x80cfafd]

2009-09-18 17:09:18 [2002] [30] PANIC: /lib/libpthread.so.0 [0xb7faa1b5] 2009-09-18 17:09:18 [2002] [30] PANIC: /lib/libc.so.6(clone+0x5e) [0xb7abd3be]

addr2line -e /usr/gateway/sbin/bearerbox 0x80d8fcc 0x8065c88 0x8057e50 0x80596b9 0x80cfafd 0xb7faa1b5 0xb7abd3be

/usr/src/packages/SOURCES/gateway/gwlib/log.c:542
/usr/src/packages/SOURCES/gateway/gw/msg.c:245
/usr/src/packages/SOURCES/gateway/gw/bb_boxc.c:199
/usr/src/packages/SOURCES/gateway/gw/bb_boxc.c:656
/usr/src/packages/SOURCES/gateway/gwlib/gwthread-pthread.c:135
??:0
??:0

Tcpdump

17:09:18.100983 IP 10.12.0.50.29000 > 172.31.1.48.4201: S 3500919925:3500919925(0) ack 739634900 win 5840 <mss 1460,nop,

nop,sackOK>

0x0000: 4500 0030 0000 4000 4006 e747 c129 e507 E.. 0...@.@..G.).. 0x0010: ac1f 0130 7148 1069 d0ab cc75 2c15 eed4 ... 0qH.i...u,... 0x0020: 7012 16d0 df01 0000 0204 05b4 0101 0402 p............... 17:09:18.101524 IP 172.31.1.48.4201 > 10.12.0.50.29000: . ack 1 win 65535 0x0000: 4500 0028 939b 4000 7e06 15b4 ac1f 0130 E.. (....@.~......0 0x0010: c129 e507 1069 7148 2c15 eed4 d0ab cc76 .)...iqH,......v

      0x0020:  5010 ffff 2296 0000 0000 0000 0000       P...".........

17:09:18.114337 IP 172.31.1.48.4201 > 10.12.0.50.29000: P 1:169(168) ack 1 win 65535 0x0000: 4500 00d0 939e 4000 7e06 1509 ac1f 0130 e.....@.~......0 0x0010: c129 e507 1069 7148 2c15 eed4 d0ab cc76 .)...iqH,......v 0x0020: 5018 ffff 82ac 0000 0000 00a4 ff53 4d42 P............SMB 0x0030: 7200 0000 0008 0140 0000 0000 0000 0000 r......@........ 0x0040: 0000 0000 0000 4006 0000 0100 0081 0002 ......@......... 0x0050: 5043 204e 4554 574f 524b 2050 524f 4752 PC.NETWORK.PROGR 0x0060: 414d 2031 2e30 0002 4d49 4352 4f53 4f46 AM. 1.0..MICROSOF 0x0070: 5420 4e45 5457 4f52 4b53 2031 2e30 3300 T.NETWORKS. 1.03. 0x0080: 024d 4943 524f 534f 4654 204e 4554 574f .MICROSOFT.NETWO 0x0090: 524b 5320 332e 3000 024c 414e 4d41 4e31 RKS. 3.0..LANMAN1 0x00a0: 2e30 0002 4c4d 312e 3258 3030 3200 0253 . 0..LM1.2X002..S 0x00b0: 616d 6261 0002 4e54 204c 414e 4d41 4e20 amba..NT.LANMAN. 0x00c0: 312e 3000 024e 5420 4c4d 2030 2e31 3200 1.0..NT.LM. 0.12. 17:09:18.114348 IP 10.12.0.50.29000 > 172.31.1.48.4201: . ack 169 win 6432 0x0000: 4500 0028 999f 4000 4006 4db0 c129 e507 E.. (....@.@.M..).. 0x0010: ac1f 0130 7148 1069 d0ab cc76 2c15 ef7c ... 0qH.i...v,..|

      0x0020:  5010 1920 08ce 0000                      P.......

17:09:18.116709 IP 10.12.0.50.29000 > 172.31.1.48.4201: F 1:1(0) ack 169 win 6432 0x0000: 4500 0028 99a0 4000 4006 4daf c129 e507 E.. (....@.@.M..).. 0x0010: ac1f 0130 7148 1069 d0ab cc76 2c15 ef7c ... 0qH.i...v,..|

      0x0020:  5011 1920 08cd 0000                      P.......

Sincerely,
Michael Zervakis