Date: Mon, 9 Jan 2012 16:05:14 GMT From: Denis Seleznev <denis5594@gmail.com> To: freebsd-gnats-submit@FreeBSD.org Subject: www/163958: telnetd stack overflow exploit Message-ID: <201201091605.q09G5ER0024229@red.freebsd.org> Resent-Message-ID: <201201091610.q09GA7Ua024567@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 163958 >Category: www >Synopsis: telnetd stack overflow exploit >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-www >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Jan 09 16:10:07 UTC 2012 >Closed-Date: >Last-Modified: >Originator: Denis Seleznev >Release: 8.2-STABLE >Organization: >Environment: FreeBSD elf.dyndns.org 8.2-STABLE FreeBSD 8.2-STABLE #1: Sun Sep 25 13:32:50 SAMST 2011 denis@elf.dyndns.org:/usr/obj/usr/src/sys/EEE700 i386 >Description: Recently, i have found malicious activity on one of my machines - it was strange process "barbut.bsd" running as root and "talkng" process eating all the cpu and bandwitdh. Searching through logs, i've found strange behaviour of telnetd right before that activity: Jan 7 17:20:06 elf kernel: pid 25119 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:07 elf kernel: pid 25120 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:08 elf kernel: pid 25121 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:08 elf kernel: pid 25122 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:09 elf kernel: pid 25123 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:10 elf kernel: pid 25124 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:11 elf kernel: pid 25125 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:11 elf kernel: pid 25126 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:13 elf kernel: pid 25129 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:14 elf kernel: pid 25130 (telnetd), uid 0: exited on signal 10 (core dumped) Jan 7 17:20:15 elf kernel: pid 25131 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 17:20:15 elf kernel: pid 25132 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:44:51 elf kernel: pid 25281 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:45:22 elf kernel: pid 25284 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:45:53 elf kernel: pid 25285 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:46:24 elf kernel: pid 25286 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:46:55 elf kernel: pid 25287 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:47:26 elf kernel: pid 25288 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:47:57 elf kernel: pid 25289 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:48:28 elf kernel: pid 25290 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:49:04 elf kernel: pid 25293 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:49:35 elf kernel: pid 25299 (telnetd), uid 0: exited on signal 10 (core dumped) Jan 7 18:50:06 elf kernel: pid 25302 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:50:37 elf kernel: pid 25303 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:57:26 elf kernel: pid 25319 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:57:57 elf kernel: pid 25320 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:58:28 elf kernel: pid 25321 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:58:59 elf kernel: pid 25322 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 18:59:29 elf kernel: pid 25323 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:00:00 elf kernel: pid 25324 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:00:31 elf kernel: pid 25343 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:01:02 elf kernel: pid 25346 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:01:38 elf kernel: pid 25351 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:02:09 elf kernel: pid 25361 (telnetd), uid 0: exited on signal 10 (core dumped) Jan 7 19:02:40 elf kernel: pid 25362 (telnetd), uid 0: exited on signal 11 (core dumped) Jan 7 19:03:11 elf kernel: pid 25363 (telnetd), uid 0: exited on signal 11 (core dumped) It is the only such an occurence, it never happened before or after. Now i have entirely disabled inetd to prevent further attacks. I am pretty sure that infection was caused by telnetd because i have enabled only ssh and inetd+telnetd, moreover, i searched through the logs very carefully, and there was no succsessfull connections by ssh, nor telnet. telnetd core dump: http://ifile.it/w49d81n I have saved "talkng" file and can provide it for further investigation, if you so choose. >How-To-Repeat: Who knows, maybe enabling telnel, or running that "talkng" executable will reproduce the problem. >Fix: Disable inted, telnetd, mount /tmp with noexec, check home,/root,/tmp directory for strange executables >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201201091605.q09G5ER0024229>