Date: Mon, 2 Feb 2015 18:48:09 +0100
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: "Brandon Perry" <bperry.volatile@...il.com>
Cc: fulldisclosure@...lists.org, bugtraq@...urityfocus.com
Subject: Re: [FD] iTunes 12.1 for Windows: still outdated and VULNERABLE 3rd
	party libraries,
	still UNQUOTED and VULNERABLE pathnames C:\Program Files\...

"Brandon Perry" <bperry.volatile@...il.com> wrote:

>I think you would get more traction on possibly getting Apple to fix these
> if you wrote exploits proving they were a problem.

Do you mean something like

    Copy %COMSPEC% Program.exe
    MakeCAB.Exe Program.exe
    Delete Program.exe
    WUSA.Exe "%CD%\Program.ex_" /Extract:%SystemDrive%

which according to the MSRC (which Apple usually refers to) does not qualify
since it only exploits the braindead autoelevation of the user account
control in its default setting, although every user of Windows 7 and later
who uses one of the user accounts created during Windows setup can use this
trivial exploit?

Mitigation(s): use standard user accounts!
               disable auto-elevation, set UAC to "always notify".

To quote <https://support.microsoft.com/kb/2526083/en-us>:

| One of the common misconceptions about UAC and about Same-desktop Elevation
| in particular is that it prevents malware from being installed or from
| gaining administrative rights. First, malware can be written not to require
| administrative rights, and malware can be written to write just to areas in
| the user's profile. More important, Same-desktop Elevation in UAC is not a
| security boundary and can be hijacked by unprivileged software that runs on
| the same desktop. Same-desktop Elevation should be considered a convenience
| feature, and from a security perspective, "Protected Administrator" should
| be considered the equivalent of "Administrator." By contrast, using Fast
| User Switching to log on to a different session by using an administrator
| account involves a security boundary between the administrator account and
| the standard user session.

stay tuned!
Stefan

PS: if your applications are vulnerable to CWE-428: FIX THEM, NOW!

> On Sat, Jan 31, 2015 at 10:11 AM, Stefan Kanthak <stefan.kanthak@...go.de>
> wrote:
> 
>> Hi @ll,
>>
>> See <http://seclists.org/bugtraq/2014/Oct/164>,
>> <http://seclists.org/fulldisclosure/2014/Oct/109>,
>> <http://seclists.org/fulldisclosure/2014/Aug/44>,
>> <http://seclists.org/fulldisclosure/2014/Aug/33> and
>> <http://seclists.org/fulldisclosure/2014/Jul/30> for the
>> prequel.
>>
>>
>> The just released iTunes 12.1 for Windows comes again with
>> outdated and VULNERABLE 3rd party libraries.
>>
>> In AppleMobileDeviceSupport.msi:
>>
>> * libeay32.dll and ssleay32.dll 0.9.8za from 2014-06-05
>>
>>   The current version is 0.9.8ze and has 21 security fixes
>>   which are missing in 0.9.8za; see <http://openssl.org/news/>
>>
>>   At last, these DLLs are no more 7 years old as before, but
>>   "only" 7 months old.
>>
>>
>> * libcurl.dll 7.16.2
>>
>>   is almost EIGHT years old and has at least 22 unfixed CVEs!
>>
>>   The current version is 7.40.0; for the fixed vulnerabilities
>>   see <http://curl.haxx.se/docs/security.html>
>>
>>
>> In AppleApplicationSupport.msi:
>>
>> * msvcr100.dll and msvcp100.dll 10.0.40219.1 from 2011-02-20
>>
>>   These are the runtime DLLs for Visual C++ 2010 RTM.
>>
>>   The current version is but 10.0.40219.325; see
>>   https://technet.microsoft.com/library/security/bulletin/MS11-025
>>
>>
>>
>> Additionally the following VULNERABLE[*] command lines with unquoted
>> pathnames containing spaces are registered.
>>
>> By AppleApplicationSupport.msi:
>>
>>
>> [HKEY_CLASSES_ROOT\CLSID\{fdd068c2-d51a-4175-8a20-5cbc704ea3bd}\LocalServer32]
>> @="[#AppleApplicationSupport_APSDaemon.exe]"
>>
>>
>> [HKEY_CLASSES_ROOT\CLSID\{6812639B-FD61-4329-9901-22CFDBD690FE}\LocalServer32]
>> @="[#AppleApplicationSupport_APSDaemon.exe]"
>>
>>
>> [HKEY_CLASSES_ROOT\CLSID\{D9E904CA-8865-42E7-B0F0-B7B8C4D54D70}\LocalServer32]
>> @="[#AppleApplicationSupport_APSDaemon.exe]"
>>
>>
>> For beginners: the value of the unnamed registry entry is a COMMAND
>> LINE and has to be quoted properly!
>>
>> From <https://msdn.microsoft.com/library/ms683844.aspx>
>>
>> | To help provide system security, use quoted strings in the path to
>> | indicate where the executable filename ends and the arguments begin.
>>
>> As of Windows 2003 developers who are NOT completely unaware of
>> Microsofts documentation might want to use the "ServerExecutable"
>> registry entry described there too.
>> But 12 years are surely way too short for Apple's developers, QA and
>> management to learn about such "new" features which help improve safety
>> and security.
>>
>>
>> By iTunes.msi:
>>
>> [HKEY_CLASSES_ROOT\itms\shell\open\command]
>> @="[#iTunes.exe] /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\iTunes\shell\open\command]
>> @="[#iTunes.exe] /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\daap\shell\open\command]
>> @="[#iTunes.exe] /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\itmss\shell\open\command]
>> @="[#iTunes.exe] /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\itsradio\shell\open\command]
>> @="[#iTunes.exe] /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\itunesradio\shell\open\command]
>> @="[#iTunes.exe] /url \"%1\""
>>
>> [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\iTunes\shell\open\command]
>> @="[#iTunes.exe]"
>>
>> [HKEY_CLASSES_ROOT\itpc\shell\open\command]
>> @="[#iTunes.exe] /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\itls\shell\open\command]
>> @="[#iTunes.exe] /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itls\shell\open\command]
>> @="[INSTALLDIR]iTunes.exe /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\pcast\shell\open\command]
>> @="[INSTALLDIR]iTunes.exe /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.daap\shell\open\command]
>> @="[INSTALLDIR]iTunes.exe /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itms\shell\open\command]
>> @="[INSTALLDIR]iTunes.exe /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itmss\shell\open\command]
>> @="[INSTALLDIR]iTunes.exe /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.itpc\shell\open\command]
>> @="[INSTALLDIR]iTunes.exe /url \"%1\""
>>
>> [HKEY_CLASSES_ROOT\iTunes.AssocProtocol.pcast\shell\open\command]
>> @="[INSTALLDIR]iTunes.exe /url \"%1\""
>>
>>
>> From <http://msdn.microsoft.com/library/cc144175.aspx>:
>>
>> | If any element of the command string contains or might contain
>> | spaces, it must be enclosed in quotation marks. Otherwise, if
>>           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> | the element contains a space, it will not parse correctly.
>>
>>
>> See <http://home.arcor.de/skanthak/sentinel.html> if you want to
>> detect software with this 20+ year old vulnerability[*] without
>> dissecting its *.MSI files.
>>
>>
>> Until Apple's developers, their QA and their managers start to
>> develop a sense for their customers safety and security:
>> stay away from Apple's (Windows) software!
>>
>>
>> stay tuned
>> Stefan Kanthak
>>
>>
>> [*] <https://cwe.mitre.org/data/definitions/428.html>
>>     You'll read more about it soon!
>>
>> _______________________________________________
>> Sent through the Full Disclosure mailing list
>> https://nmap.org/mailman/listinfo/fulldisclosure
>> Web Archives & RSS: http://seclists.org/fulldisclosure/
>>
> 
> 
> 
> -- 
> http://volatile-minds.blogspot.com -- blog
> http://www.volatileminds.net -- website
>

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists