Message-ID: <42432BA5.4080307@logiclibrary.com>
Date: Thu, 24 Mar 2005 13:05:41 -0800
From: Matt Hargett <matt.hargett@...iclibrary.com>
To: bugtraq@...urityfocus.com, vuln@...unia.com,
	full-disclosure@...ts.grok.org.uk
Subject: LogicLibrary BugScan VSR,Trillian 2.0, 3.0 and 3.1


LogicLibrary BugScan Vulnerability Summary Report (VSR)
Trillian 2.0, 3.0 and 3.1
3/23/2005

I. Background
This report is based on the example in .Guidelines for Security
Vulnerability Reporting and Response,. provided by the Organization
for Internet Safety (OIS). The template for this document can be
found at http://www.oisafety.org/guidelines/secresp.html.

Trillian is an all-in-one instant messaging client on Windows,
produced by Cerulean Studios. It allows users to be on several IM and
chat networks all via a single client. It also has an extensible
plug-in system and supplies plug-ins for RSS feed reading, POP3 mail
notifications, etc.

II. Description
The AIM, Yahoo, MSN, RSS and other plug-ins connect to an external
Web server at various points. A buffer iteration overflow in their
handling of HTTP 1.1 response headers in these plug-ins was found
using BugScan 2003A. For attackers to exploit this vulnerability,
they would need to take over the Web server being connected to or
DNS/route poison the victim into connecting to their malicious Web
server.

The vulnerability can be demonstrated in Trillian 2.0 by setting up a
netcat listener on port 80and then pointing Trillian's proxy, RSS
reader or anything else that connects to HTTP to the netcat listener.
After the client connects, piping a very long string followed by a
carriage return will reliably crash the client. Specially crafted
input may result in malicious code being executed under the context
of the user that Trillian is running as. This problem is compounded
because the same vulnerable code appears to have been copied into
several different components and locations.

In Trillian 3.0, many instances of the bug were fixed, but at least
one has persisted in the Yahoo IM component. This mistake is probably
due to the code duplication mentioned above. Trillian 3.0 is compiled
with the .Buffer Security Check. option in Visual C++ 7.1 (also known
as stack canaries), which helps prevent the exploitation of
stack-based overflows. Since this is a heap overflow, the security
check does not appear to help.

In Trillian 3.1, the aforementioned Yahoo IM vulnerabilities have
still not been fixed. There are still two exploitable buffer
iteration bugs. One is at offset 0x520296c6 and the other is at
offset 0x5201a05f. A Trillian developer who has access to the symbols
and source code should use these offsets to locate and fix these
problems.

III. Analysis
These bugs were found using BugScan 2003A, which was released in
October 2003. BugScan 2003A was able to detect the buffer iteration
bug and the fact that it was likely to be exploitable due to its
operating on user-supplied data. You can see another example of the
exploitable code by looking at location 0x10004464 in Trillian 2.0's
rss.dll. The vulnerable source probably looks approximately like
this:

while ((ch != '\n') && (bytes != 0))
{
int bytes = recv(socket, &ch, 1, ...);
*buf++ = ch;
}

The buffer will overflow if a long string with many characters is
received before the newline character over this network connection.

IV. Affected Configurations
All Trillian 2.0 versions have many of these kinds of exploitable
vulnerabilities. Many were fixed in Trillian 3.0 and 3.1, but some
still remain.

IV. Vendor Response
While initially responsive, Cerulean stopped responding to emails
after detailed reports were given. No official response at the time
of the issuance of this report.

V. CVE and OSVDB information
No official CVE or OSVDB number assigned at the time of the issuance
of this report.

VI. Disclosure Timeline
October 2003 Initial vendor notification.
November 2003 Notified vendor again via support IRC channels,
verified reception of BugScan report.
January 2004 Vendor promised fix in upcoming 3.0 release.
December 2004 Trillian 3.0 released, second BugScan showed a few
unfixed vulnerabilities remained.
February 2005 Contacted Trillian again, specifying locations of
unfixed problems.
February 18, 2005 Contacted specific employees and forwarded the VSR.
Received no response.
February 23, 2005 Contacted specific employees and forwarded the VSR.
Received no response.
February 24, 2005 Trillian 3.1 update released with no additional
security fixes from Trillian 3.0.

VII. Conclusion
LogicLibrary would like to assist in resolving this matter with
Cerulean. The resolution of these issues will be helpful to Cerulean
users, including LogicLibrary. It is recommended that users update
their version of Trillian to the latest 3.1 release, avoid using the
Yahoo IM component until patched, and use code analysis tools to
verify third-party software, such as Trillian and its plug-ins.

For more information, please contact Ralph Massaro
<ralph.massaro@...iclibrary.com>.

The public key to verify the authenticity of this email is located at
https://www.mylogiclibrary.com/pgp-pub.txt.

Powered by blists - more mailing lists