Ever since I released the seti@home exploit my poor old server
became more stressed by the minute. Current traffic forced me
to create this "emergency"-page to keep the load on my Pentium
110Mhz bareable. If you'd like to see the rest of my homepage,
please click here and be patient
while it loads (don't hold your breath!)
Both NTbugtraq and securityfocus bugtraq have bounced the exploit, but you can offcourse download it here.
I'd like to take this opportunity to inform everybody who's interested that I am looking for a place to do an internship from august 2003 untill januari 2004. I am looking for a company where I can do some security related programming. I am a 26 year old student of Infomation Technology at the TH Rijswijk in the Netherlands. I have experience with various programming and scripting languages, operating systems and protocols. If you know of a company who would be interested or if you need more details like my C.V., please contact me through email at the address below.
Can be found here
Confirmed information leaking:
This issue affects all clients.
Confirmed remote exploitable:
i386-unknown-freebsd2.2.8 (Special thanks to Niels Heinen)
SETI@home.exe (v3.07 Screensaver)
Confirmed DoS-able using buffer overflow:
The main seti@home server at shserver2.ssl.berkeley.edu
Presumed vulnerable to buffer overflow:
All other clients.
From "http://setiathome.berkeley.edu/" :
"SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data. "
"The SETI@home program is a special kind of screensaver. Like other screensavers it starts up when you leave your computer unattended, and it shuts down as soon as you return to work. What it does in the interim is unique. While you are getting coffee, or having lunch or sleeping, your computer will be helping the Search for Extraterrestrial Intelligence by analyzing data specially captured by the world's largest radio telescope. "
"The client/screensaver is available for download only from this web page - we do not support SETI@home software obtained elsewhere. This software will upload and download data only from our data server here at Berkeley. The data server doesn't download any executable code to your computer. All in all, the screensaver is much safer than the browser you're running right now!"
There are currently over four million registered users of seti@home. Over half a million of these users are "active"; they have returned at least one result within the last four weeks.
The seti@home clients use the HTTP protocol to download new workunits, user
information and to register new users. The implementation leaves two
1) All information is send in plaintext across the network. This information includes the processor type and the operating system of the machine seti@home is running on.
2) There is a bufferoverflow in the server responds handler. Sending an overly large string followed by a newline ('\n') character to the client will trigger this overflow. This has been tested with various versions of the client. All versions are presumed to have this flaw in some form.
3) A similar buffer overflow seems to affect the main seti@home server at shserver2.ssl.berkeley.edu. It closes the connection after receiving a too large string of bytes followed by a '\n'.
1) Sniffing the information exposed by the seti@home client is trivial and
very usefull to a malicious person planning an attack on a network. A
passive scan of machines on a network can be made using any packetsniffer
to grab the information from the network.
2) All tested clients have similar buffer overflows, which allowed setting eip to an arbitrairy value which can lead to arbitrairy code execution. An attacker would have to reroute the connection the client tries to make to the seti@home webserver to a machine he or she controls. This can be done using various widely available spoofing tools. Seti@home also has the ability to use a HTTP-proxy, an attacker could also use the machine the PROXY runs on as a base for this attack. Routers can also be used as a base for this attack.
3) Exploitation of the bug in the server has offcourse not been tested. Do understand that successfull exploitation of the bug in the server would offer a platform from which ALL seti@home clients can be exploited.
Is available for linux by yours truely
Is available for linux/*BSD by Zillion
2002/12/05 Information leakage discovered.
2002/12/14 Bufferoverflow in client discovered.
2002/12/31 Seti@home team contacted through their website
2003/01/07 Seti@home team contacted again.
2003/01/14 Bufferoverflow in server discovered.
2003/01/21 Seti@home team contacted again, this time through email.
2003/01/21 Seti@home team confirmed the problem.
2003/01/25 Seti@home team promissed fixed version are being build.
2003/02/03 Seti@home team informed me about problems with the fixes for the win32 version.
2003/04/06 New Seti@home clients available, advisory and linux exploit released.
2003/04/07 Zillions *BSD exploit released.
Special thanks go out to:
- Aleph1 for "Smashing the Stack for Fun and Profit".
- Niels Heinen for his work on exploiting seti@home on FreeBSD.
- Blazde and the other 0dd folks for help with the win32 shellcode.