Date: Tue, 12 Apr 2005 14:43:38 -0400
From: "iDEFENSE Labs" <labs-no-reply@...fense.com>
To: <bugtraq@...urityfocus.com>, <vulnwatch@...nwatch.org>,
	<full-disclosure@...ts.netsys.com>
Subject: iDEFENSE Security Advisory 04.12.05: Microsoft Windows CSRSS.EXE Stack Overflow Vulnerability


Microsoft Windows CSRSS.EXE Stack Overflow Vulnerability

iDEFENSE Security Advisory 04.12.05
www.idefense.com/application/poi/display?id=230&type=vulnerabilities
April 12, 2005

I. BACKGROUND

The Win32 application-programming interface (API) offers a console
windows feature that provides a means to implement command-line and 
other character-based user interfaces. The specific code for this
feature within the Windows 2000, XP and 2003 operating systems resides
in a core system process called CSRSS.EXE. This process is the main
executable for the Microsoft Client/Server Runtime Server Subsystem. The
process manages most graphical commands in Windows.

II. DESCRIPTION

Local exploitation of a stack-based buffer overflow vulnerability within
various versions of Microsoft Corp.'s Windows operating system allows
attackers to execute arbitrary code with SYSTEM privileges.

Console windows are created and managed by code in the WINSRV.DLL file
that resides in the CSRSS.EXE process. This file contains the
server-side version of the 32-bit user and GDI routines (graphics
engine). When a user selects the "Properties" item from the system menu
of a console window, a data structure containing information about the
console window is copied into the file-mapping object. The text of an
assert in the checked build appears to indicate that this structure is
called CONSOLE_STATE_INFO, which has the following structure:

    typedef struct _CONSOLE_STATE_INFO
    {
      /* 0x00 */  DWORD cbSize;
      /* 0x04 */  COORD ScreenBufferSize;
      /* 0x08 */  COORD WindowSize;
      /* 0x0c */  POINT WindowPosition;
      /* 0x14 */  COORD FontSize;
      /* 0x18 */  DWORD FontFamily;
      /* 0x1c */  DWORD FontWeight;
      /* 0x20 */  WCHAR FaceName[32];     /* Buffer Overflow */
      /* 0x60 */  DWORD CursorSize;
      /* 0x64 */  BOOL  FullScreen;
      /* 0x68 */  BOOL  QuickEdit;
      /* 0x6c */  BOOL  DefaultWindowPos;
      /* 0x70 */  BOOL  InsertMode;
      /* 0x74 */  WORD  ScreenColors;
      /* 0x76 */  WORD  PopupColors;
      /* 0x78 */  BOOL  HistoryNoDup;
      /* 0x7c */  DWORD HistoryBufferSize;
      /* 0x80 */  DWORD NumberOfHistoryBuffers;
      /* 0x84 */  COLORREF ColorTable[16];
      /* 0xc4 */  DWORD CodePage;
      /* 0xc8 */  DWORD hwnd;
      /* 0xcc */  WCHAR ConsoleTitle[2];
    } CONSOLE_STATE_INFO, *PCONSOLE_STATE_INFO;

The values contained within this struct are passed as a file-mapping
object to code within WINSRV.DLL that does not properly validate the
data. Passing a CONSOLE_STATE_INFO of all zero's can induce an integer
divide-by-zero exception in the CSRSS process that will cause the
process to terminate and the system to crash (blue screen) shortly
thereafter. The CONSOLE_STATE_INFO data structure contains a null
terminated string specifying the name of a font, FaceName[32]. This
string is copied into a fixed sized stack buffer without any sanity
checking via the wcscpy() function, as can be seen in the following
assembly excerpt from WINSRV.DLL on Windows 2000 Service Pack 4 Checked
Build:

    0x5FFB39DF push [ebp+lpFaceName]
    0x5FFB39E2 lea eax, [ebp-54h]
    0x5FFB39E5 push eax
    0x5FFB39E6 call j_wcscpy

By supplying a string longer than 32 bytes, an attacker can trigger the
stack-based buffer overflow to gain control of the computer and
eventually execute arbitrary code.

III. ANALYSIS

Exploitation allows local unprivileged users to potentially execute
arbitrary code on affected systems with SYSTEM privileges. An attacker
with non-privileged access to a vulnerable system can leverage this
vulnerability to fully compromise the underlying system. Exploitation of
the described vulnerability requires that the attacker be able to create
a console window. This attack may be used on public terminals to break
imposed restrictions that otherwise prevent users from fully controlling
the computer.

IV. DETECTION

iDEFENSE has confirmed the existence and exploitability of this
vulnerability in Microsoft Windows 2000 SP4 and Microsoft Windows XP
SP1a containing the following versions of CSRSS.EXE and WINSRV.DLL:

    * Windows 2000 SP4 CSRSS.EXE  - 5.0.2195.6601
    * Windows 2000 SP4 WINSRV.DLL - 5.0.2195.6699
    * Windows XP SP1a  CSRSS.EXE  - 5.0.2195.6601
    * Windows XP SP1a  WINSRV.DLL - 5.0.2195.6699

iDEFENSE has confirmed the existence of this vulnerability as a local
denial of service (blue screen) on Windows XP SP2 and Windows 2003. It
is believed that code execution may also be possible on these platforms,
though more difficult, as both platforms employ buffer overflow
exploitation prevention methods.

V. WORKAROUND

Restrict console access on public terminals where security is a concern.
This can be accomplished by creating the following registry key:

    HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System

Add a DWORD named DisableCMD with the value "1" to disable command
prompt and batch files or the value "2" to disable command prompt but
allow batch files.

VI. VENDOR RESPONSE

This vulnerability is addressed in Microsoft Security Bulletin MS05-018
available at:

http://www.microsoft.com/technet/security/Bulletin/MS05-018.mspx

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2005-0551 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

01/04/2005      Initial vendor notification
01/04/2005      Initial vendor response
04/12/2005      Coordinated public disclosure

IX. CREDIT

David Fritz is credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@...fense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.

There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.

Powered by blists - more mailing lists