Vulnerable Weekends #7

Vulnerability Report #7: Iptools rcmd Denial of Service Vulnerability

Vulnerable Product: Installations of Iptools with version 0.1.4

CVE ID: NA

CVSS v2 Score:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE

Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL
Base Score: 5

Exploitability: PROOF-OF-CONCEPT
Remediation Level: WORKAROUND
Report Confidence: UNCORROBORATED
Temporal Score: 4.1

Details:
Iptools is a popular set of tiny TCP/IP utilities implemented as Perl scripts, that include a minimalist webserver, a remote command server on the lines of Telnet, a TFTP server/client, SNMP browser, etc. The toolset has been reported to be vulnerable to a denial of service (DoS) vulnerability, specifically within its remote command server script, rcmd.

The vulnerable utility receives user-supplied input through its listening port, TCP/23, which is then tested against a set of weak sanitization checks. This input is used as a placeholder for the EXPR parameter used by the internal chdir function which parses it as a filename reference. Since this parameter could reference a string of an unbounded length, the directory change operation could generate an untrappable exception. This flaw could make the vulnerable utility unstable, effectively terminating the Perl interpreter abnormally, leading to the DoS condition. The following code snippet depicts where the vulnerability could have been introduced within the rcmd script:

chop($curdir=`cd`);
print NS "$curdir> ";
while (<NS>) {
  print "Client request : ";
    print;
  CASE: {
      /cd / && do { $dir=$'; $dir=~s/\015\012//; print $dir if $debug;
                    chdir "$dir" || print NS "Invalid directory\015\012"  ; last CASE; };
      /^(\b)*(.:)/ && do { $drive=$2; ; print "driver:[$drive]" if $debug;
                    chdir "$drive" || print NS "Invalid drive\015\012"  ; last CASE; };

An official confirmation and software updates are currently unavailable. Users are requested to avoid using the vulnerable utility until official fixes are released. For a workaround, users could consider introducing restrictive firewall policies that prohibit unnecessary access to the vulnerable script from an unauthorized source.

Vulnerability Sources:
http://www.securityfocus.com/bid/51312/
http://iptools.sourceforge.net/iptools.html

Generic Sources:
http://cve.mitre.org
http://www.first.org/cvss/cvss-guide.html
http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2

Vulnerable Weekends #3

Introduction:
Report #3A analyzes the Cisco WebEx Player remote code execution vulnerability. The vendor states that a functional exploit for this vulnerability exists, however no public sources confirm its availability.

Report #3B analyzes the ISC DHCP denial of service vulnerability. Although, DHCP requests will only be received from local clients, attackers could also exploit this vulnerability from an adjacent network using a relay agent that comes bundled with the vulnerable product suite.

Vulnerability Report #3A: Cisco WebEx Player WRF Files Processing Remote Code Execution Vulnerability

Vulnerable Product: Installations of Cisco WebEx Player with versions T26 prior to SP49 EP40 and T27 prior to SP28

CVE ID: CVE-2011-3319

CVSS v2 Score:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE

Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE
Base Score: 9.3

Exploitability: FUNCTIONAL
Remediation Level: OFFICIAL FIX
Report Confidence: CONFIRMED
Temporal Score: 7.7

Details:
Cisco WebEx Player is an application that helps to playback or edit WebEx meetings recording, WebEx Recording Format (WRF) files.

The vulnerable software fails to perform sufficient sanitization on user-supplied input received via a malicious .wrf file. A shared library, atdl2006.dll, has been identified as the source of this vulnerability. The vulnerable library uses an unsanitized, user-supplied size parameter to allocate a dynamic buffer via the memcpy() function. However, due to insufficient checks on this parameter, a heap-based buffer overflow could be triggered.

Attackers who can successfully lure a targeted user to open a malicious .wrf file or visit a crafted webpage, could exploit this vulnerability. Once exploited, the attacker could execute arbitrary code on the targeted system with the privileges of the user.

The vendor, Cisco, has confirmed this vulnerability and provided official fixes to mitigate it. Users are requested to refer to the vendor advisory for further details.

Vulnerability Sources:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-webex
http://www.zerodayinitiative.com/advisories/ZDI-11-341/
http://www.securityfocus.com/bid/50373


Vulnerability Report #3B: ISC DHCP Incorrect Extended Regular Expressions Processing Denial of Service Vulnerability

Vulnerable Product: Installations of ISC DHCP server with versions prior to 4.2.3-P1 and 4.1-ESV-R4

CVE ID: CVE-2011-4539

CVSS v2 Score:
Access Vector: ADJACENT NETWORK
Access Complexity: MEDIUM
Authentication: NONE

Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL
Base Score: 2.9

Exploitability: UNPROVEN
Remediation Level: OFFICIAL FIX
Report Confidence: CONFIRMED
Temporal Score: 2.1

Details:
Internet Systems Consortium (ISC) provides an open source, reference implementation for Dynamic Host Configuration Protocol (DHCP) which includes components such as a server, a client and a relay agent.

The vulnerability exists within the server component which is responsible for handling DHCP requests received from local clients or from adjacent clients via a relay agent.

The vulnerable component incorrectly evaluates an extended regular expression consisting of a comparison operator such as ~= or ~~. While processing a DHCP request, if such operators are encountered within its configuration file, dhcpd.conf, the vulnerable component could terminate abnormally, leading to a denial of service (DoS) condition.

The vulnerability, however, could only be triggered if the targeted server has been configured to parse extended regular expressions. As such, only those installations where an administrator has manually configured the vulnerable component to use such operators, are exposed to this vulnerability.

The vendor, ISC, has confirmed this vulnerability and released patches for its mitigation. Users are requested to refer to the vendor advisory for further details.

Vulnerability Sources:
https://www.isc.org/software/dhcp/advisories/cve-2011-4539
http://www.securityfocus.com/bid/50971

Generic Sources:
http://cve.mitre.org
http://www.first.org/cvss/cvss-guide.html
http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2

Vulnerable Weekends #1

Introduction:

Last week Mozilla revised the major version number for its popular web browsing application, Firefox, taking it to version 8.0. Its been hardly a few days since Firefox 8.0 has been available publicly, reports about a denial of service (DoS) vulnerability within the latest and prior releases started to make news. I have tried to analyze this vulnerability and #1A is a report for the same.

The #1B report provides yet another interesting update related to a remote code execution (RCE) vulnerability confirmed within ProFTPd.

Vulnerability Report #1A: Mozilla Firefox OnStartRequest() Function XPCOM Object Processing Denial of Service Vulnerability

Vulnerable Product: Installations of Mozilla Firefox with versions 8.0 and prior.

CVE ID: Not available

CVSS v2 Score:

Access Vector: NETWORK

Access Complexity: MEDIUM

Authentication: NONE

Confidentiality Impact: NONE

Integrity Impact: NONE

Availability Impact: PARTIAL
Base Score: 4.3

Exploitability: PROOF-OF-CONCEPT

Remediation Level: UNAVAILABLE

Report Confidence: UNCORROBORATED
Temporal Score: 3.7

Details:

Mozilla Firefox, the popular open source web browsing application, reportedly contains a vulnerability which could be leveraged by an attacker to cause a denial of service (DoS) condition on the targeted system.

The vulnerable web browser performs insufficient sanitization on user-supplied input encountered while processing crafted webpages.

Online reports indicate that the OnStartRequest() function which is defined within the nsObjectLoadingContent.cpp source file of the affected software is where the vulnerability resides. This function erroneously permits a comparison between a Cross Platform Common Object Model (XPCOM) object with a NULL value received as input. This flaw could return a NS_BINDING_ABORTED value to the calling function, leading to an abnormal termination of the vulnerable web browser.

An attacker who can successfully lure a targeted user to visit a malicious webpage that contains crafted input for the vulnerable function or who can persuade a user to open a malicious web page received as an e-mail attachment, could trigger this vulnerability. When the vulnerable web browser tries to process such crafted webpages, the above mentioned flaw is triggered, leading to the DoS condition on the targeted system.

Proof-of-concept (PoC) code to demonstrate the validity of the vulnerability claim and an impact of a successful exploit attempt has been made available on public sources like Exploit-DB.

The vendor, Mozilla, has not yet confirmed this vulnerability and as such there are no official patches or updates available for this vulnerability. Users are requested to get in touch with the vendor's support services to obtain updates for their installations.

Vulnerability Sources:

http://xforce.iss.net/xforce/xfdb/71288

http://www.securityfocus.com/bid/50667

Vulnerability Report #1B: ProFTPd pr_cmd_dispatch_phase() Function Response Code Handling Arbitrary Code Execution Vulnerability

Vulnerable Product:Installations of ProFTPd versions with 1.3.3 and prior.

CVE ID: CVE-2011-4130

CVSS v2 Score:

Access Vector: NETWORK

Access Complexity: LOW

Authentication: SINGLE

Confidentiality Impact: COMPLETE

Integrity Impact: COMPLETE

Availability Impact: COMPLETE
Base Score: 9.0

Exploitability: UNPROVEN

Remediation Level: OFFICIAL FIX

Report Confidence: CONFIRMED
Temporal Score: 6.7

Details:

ProFTPd, the popular FTP daemon, reportedly contains a vulnerability which could be leveraged by an attacker to execute arbitrary code on the targeted system.

The vulnerable daemon fails to manage a pool used for the client responses. While processing user requests, if an exceptional condition occurs, the daemon uses a response pointer to select user response to be sent for the triggered exception. However, due to a flaw within the code responsible for handling exceptions, the response pointer is incorrectly restored to the appropriate response code and it could be made to point to a desired memory location.

Online reports indicate that the pr_cmd_dispatch_phase() function defined within the main.c source file of the vulnerable daemon is where the vulnerability resides. The vulnerable function provides a mechanism for issuing calls to the registered ProFTPd modules. However, before entering the requested module, the daemon essentially stores the resp_pool state so that it can be used upon return. While the control is within the requested module, if an exception is triggered, the vulnerable daemon fails to restore resp_pool state, which could then be altered using a controlled memory corruption.

An attacker who can complete the initial authentication phase on the targeted system could successfully trigger this vulnerability. When the vulnerable daemon tries to handle an explicitly triggered exception, it could allow arbitrary code execution on the targeted system.

The vendor, ProFTPd.org, has confirmed this vulnerability and provided official updates to mitigate it. Users are requested to immediately apply the latest updates on their vulnerable installations.

Vulnerability Sources:

http://www.zerodayinitiative.com/advisories/ZDI-11-328

http://www.securityfocus.com/bid/50631

Generic Sources:

http://cve.mitre.org

http://www.first.org/cvss/cvss-guide.html

http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2