======================================================================

= Security Objectives Advisory (SECOBJADV-2008-02) =

======================================================================

Cygwin Installation and Update Process can be Subverted Vulnerability

http://www.security-objectives.com/advisories/SECOBJADV-2008-02.txt

AFFECTED: Cygwin setup.exe 2.573.2.2

PLATFORM: Intel / Windows

CLASSIFICATION: Insufficient Verification of Data Authenticity (CWE-345)

RESEARCHER: Derek Callaway

IMPACT: Client-side code execution

SEVERITY: Medium

DIFFICULTY: Moderate

REFERENCES: CVE-2008-3323, RedHat Bugzilla Bug 449929

BACKGROUND

Cygwin is a Linux-like environment for Windows. It consists of two parts:

1. A DLL (cygwin1.dll) which acts as a Linux API emulation layer providing

substantial Linux API functionality.

2. A collection of tools which provide Linux look and feel.

SUMMARY

Cygwin is a Linux-like environment for Microsoft Windows copyrighted by

Red Hat, Inc. Tarball software packages are installed and updated via

setup.exe. This program downloads a package list and packages from

mirrors over plaintext HTTP or FTP. The package list contains MD5

checksums for verifying package integrity. If a rogue server answers the

HTTP request responsible for package updates and responds with a

modified MD5 string setup.exe will download and install a malicious package.

ANALYSIS

To successfully exploit this vulnerability an attacker must be able to

somehow position themself such that they can impersonate a Cygwin mirror.

As a proof-of-concept the local hosts file was modified but an attack

that occurs in the wild can be accomplished through DNS cache

poisoning, ARP redirection, TCP hijacking, impersonation of a Wi-Fi

Access Point, etc. The attacker also would have configured a rogue web

server to push out package code of their choosing. The success of

attacks that utilize the DNS cache poisoning approach has recently been

compounded by Kaminsky's birthday paradox technique (CVE-2008-1447.)

For testing purposes, gzip was used as the malicious package although

any and all packages can be trojanned (including base-files.) gzip was

chosen for testing purposes because it is so common. A real attacker

would probably target more of a lynchpin package like bash. The version,

time, size, and MD5 sum of the gzip entry in the setup.ini file was

modified for the rogue Cygwin server. The location of the altered gzip

package was /sourceware/cygwin/release/gzip/gzip-3.1.33-7.tar.bz2.

When setup.exe is executed it will automatically download the modified

package from the rogue server. /usr/bin/gzip was replaced by /usr/bin/ls

during Security Objectives' testing. In a real attack scenario bash

could be trojanned or a complete rootkit could be installed. The user is

likely to not even notice the malicious package being setup as it is

auto-selected for installation.

WORKAROUND

Refrain from using Cygwin setup.exe versions prior to 2.573.2.3.

VENDOR RESPONSE

Cygwin Setup.exe version 2.573.2.3 addresses this vulnerability.

http://cygwin.com/setup/snapshots/setup-2.573.2.3.exe

DISCLOSURE TIMELINE

20-May-2008 Discovery of Vulnerability

22-May-2008 Developed Proof-of-Concept

25-May-2008 Reported to Vendor

04-Jun-2008 RedHat Bugzilla ID Opened

19-Jun-2008 Vendor Supplied Patched Program for Testing

21-Jun-2008 Fix Applied to Bug in Original Patch

22-Jul-2008 New Setup Program Tested and Verified

25-Jul-2008 Published Advisory

ABOUT SECURITY OBJECTIVES

Security Objectives is a security centric consultancy and software development

corporation which operates in the area of application assurance software.

Security Objectives employs methods that are centered on software

comprehension, therefore a more in-depth contextual understanding of the

application is developed.

http://security-objectives.com/

LEGAL

Permission is granted for electronic distribution of this advisory.

It may not be edited without the written consent of Security Objectives.

The information contained in this advisory is believed to be accurate based on

currently available information and is provided "as is" without warranty of

any kind, either expressed or implied, including, but not limited to, the

implied warranties of merchantability and fitness for a particular purpose.

The entire risk as to the quality and performance of the information is with

you.

[ reply ]