110 lines
No EOL
3 KiB
Text
110 lines
No EOL
3 KiB
Text
#######################################################################
|
|
|
|
Luigi Auriemma
|
|
|
|
Application: EMC IRM License Server
|
|
http://www.emc.com
|
|
Versions: <= 4.6.1.1995
|
|
Platforms: Windows
|
|
Bugs: A] "version compat check" *FIPS NULL pointer
|
|
B] freezing caused by multiple commands
|
|
C] NULL pointer caused by commands after invalid version
|
|
Exploitation: remote
|
|
Date: 10 Apr 2012
|
|
Author: Luigi Auriemma
|
|
e-mail: aluigi@autistici.org
|
|
web: aluigi.org
|
|
|
|
|
|
#######################################################################
|
|
|
|
|
|
1) Introduction
|
|
2) Bugs
|
|
3) The Code
|
|
4) Fix
|
|
|
|
|
|
#######################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
|
|
|
|
From the manual:
|
|
"The IRM Server is a secure server containing a database that stores
|
|
the encryption keys needed by authorized users to access protected
|
|
content. The database also stores policies that specify who can access
|
|
the information and what they can do with it."
|
|
|
|
|
|
#######################################################################
|
|
|
|
=======
|
|
2) Bugs
|
|
=======
|
|
|
|
--------------------------------------------
|
|
A] "version compat check" *FIPS NULL pointer
|
|
--------------------------------------------
|
|
|
|
The missing *FIPS fields in the "version compat check" command leads to
|
|
a NULL pointer in execution:
|
|
|
|
004AB67B . 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C]
|
|
004AB67E . 50 PUSH EAX
|
|
004AB67F . 53 PUSH EBX
|
|
004AB680 . 8D85 5C020000 LEA EAX,DWORD PTR SS:[EBP+25C]
|
|
004AB686 . 50 PUSH EAX
|
|
004AB687 . FF75 C4 PUSH DWORD PTR SS:[EBP-3C]
|
|
004AB68A . FF55 E8 CALL DWORD PTR SS:[EBP-18] ; NULL pointer
|
|
|
|
|
|
---------------------------------------
|
|
B] freezing caused by multiple commands
|
|
---------------------------------------
|
|
|
|
Process freezing caused by some continuous malformed commands, for
|
|
example "batch begin untethered" with an Id composed by line-feeds.
|
|
|
|
Note about the proof-of-concept: manually kill the PoC when everything
|
|
seems inactive and you no longer receive data from the server so that
|
|
it will start to consume resources.
|
|
|
|
|
|
--------------------------------------------------------
|
|
C] NULL pointer caused by commands after invalid version
|
|
--------------------------------------------------------
|
|
|
|
Looks like it's possible to cause some NULL pointer dereferences if the
|
|
initial "version compat check" contains an invalid Version and then are
|
|
sent other commands.
|
|
|
|
|
|
The effect of all the vulnerabilities is the impossibility of using the
|
|
IRM server, the pvcontrol.exe process remains active but it's no longer
|
|
usable.
|
|
|
|
|
|
#######################################################################
|
|
|
|
===========
|
|
3) The Code
|
|
===========
|
|
|
|
|
|
http://aluigi.org/poc/irm_1.zip
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
4) Fix
|
|
======
|
|
|
|
|
|
No fix.
|
|
|
|
|
|
####################################################################### |