From owner-freebsd-www@FreeBSD.ORG Mon Jan 9 16:10:07 2012 Return-Path: Delivered-To: freebsd-www@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id CF8501065673 for ; Mon, 9 Jan 2012 16:10:07 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id ABB3B8FC1B for ; Mon, 9 Jan 2012 16:10:07 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q09GA7Uh024568 for ; Mon, 9 Jan 2012 16:10:07 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q09GA7Ua024567; Mon, 9 Jan 2012 16:10:07 GMT (envelope-from gnats) Resent-Date: Mon, 9 Jan 2012 16:10:07 GMT Resent-Message-Id: <201201091610.q09GA7Ua024567@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-www@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Denis Seleznev Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6A4711065670 for ; Mon, 9 Jan 2012 16:05:14 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id 58CC88FC19 for ; Mon, 9 Jan 2012 16:05:14 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.4/8.14.4) with ESMTP id q09G5EMl024230 for ; Mon, 9 Jan 2012 16:05:14 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.4/8.14.4/Submit) id q09G5ER0024229; Mon, 9 Jan 2012 16:05:14 GMT (envelope-from nobody) Message-Id: <201201091605.q09G5ER0024229@red.freebsd.org> Date: Mon, 9 Jan 2012 16:05:14 GMT From: Denis Seleznev To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: www/163958: telnetd stack overflow exploit X-BeenThere: freebsd-www@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: FreeBSD Project Webmasters List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Jan 2012 16:10:07 -0000 >Number: 163958 >Category: www >Synopsis: telnetd stack overflow exploit >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-www >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Jan 09 16:10:07 UTC 2012 >Closed-Date: >Last-Modified: >Originator: Denis Seleznev >Release: 8.2-STABLE >Organization: >Environment: FreeBSD elf.dyndns.org 8.2-STABLE FreeBSD 8.2-STABLE #1: Sun Sep 25 13:32:50 SAMST 2011 denis@elf.dyndns.org:/usr/obj/usr/src/sys/EEE700 i386 >Description: Recently, i have found malicious activity on one of my machines - it was strange process "barbut.bsd" running as root and "talkng" process eating all the cpu and bandwitdh. Searching through logs, i've found strange behaviour of telnetd right before that activity: Jan 7 17:20:06 elf kernel: pid 25119 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:07 elf kernel: pid 25120 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:08 elf kernel: pid 25121 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:08 elf kernel: pid 25122 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:09 elf kernel: pid 25123 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:10 elf kernel: pid 25124 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:11 elf kernel: pid 25125 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:11 elf kernel: pid 25126 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:13 elf kernel: pid 25129 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:14 elf kernel: pid 25130 (telnetd), uid 0: exited on signal 10 (core dumped) Jan 7 17:20:15 elf kernel: pid 25131 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:15 elf kernel: pid 25132 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:44:51 elf kernel: pid 25281 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:45:22 elf kernel: pid 25284 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:45:53 elf kernel: pid 25285 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:46:24 elf kernel: pid 25286 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:46:55 elf kernel: pid 25287 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:47:26 elf kernel: pid 25288 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:47:57 elf kernel: pid 25289 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:48:28 elf kernel: pid 25290 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:49:04 elf kernel: pid 25293 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:49:35 elf kernel: pid 25299 (telnetd), uid 0: exited on signal 10 (core dumped) Jan 7 18:50:06 elf kernel: pid 25302 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:50:37 elf kernel: pid 25303 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:57:26 elf kernel: pid 25319 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:57:57 elf kernel: pid 25320 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:58:28 elf kernel: pid 25321 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:58:59 elf kernel: pid 25322 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:59:29 elf kernel: pid 25323 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:00:00 elf kernel: pid 25324 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:00:31 elf kernel: pid 25343 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:01:02 elf kernel: pid 25346 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:01:38 elf kernel: pid 25351 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:02:09 elf kernel: pid 25361 (telnetd), uid 0: exited on signal 10 (core dumped) Jan 7 19:02:40 elf kernel: pid 25362 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:03:11 elf kernel: pid 25363 (telnetd), uid 0: exited on signal 11 (core dumped) It is the only such an occurence, it never happened before or after. Now i have entirely disabled inetd to prevent further attacks. I am pretty sure that infection was caused by telnetd because i have enabled only ssh and inetd+telnetd, moreover, i searched through the logs very carefully, and there was no succsessfull connections by ssh, nor telnet. telnetd core dump: http://ifile.it/w49d81n I have saved "talkng" file and can provide it for further investigation, if you so choose. >How-To-Repeat: Who knows, maybe enabling telnel, or running that "talkng" executable will reproduce the problem. >Fix: Disable inted, telnetd, mount /tmp with noexec, check home,/root,/tmp directory for strange executables >Release-Note: >Audit-Trail: >Unformatted: