bugtraq - EEYE: Yahoo Webcam ActiveX Controls Multiple Buffer Overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <D52FCFAE57472647956CBAEDC08DA55301695344@av-mail01.corp.int-eeye.com>
Date: Fri, 8 Jun 2007 10:58:19 -0700
From: "eEye Advisories" <Advisories@...e.com>
To: <bugtraq@...urityfocus.com>
Subject: EEYE: Yahoo Webcam ActiveX Controls Multiple Buffer Overflows

Yahoo Webcam ActiveX Controls Multiple Buffer Overflows

Release Date:
June 8, 2007

Date Reported:
June 5, 2007

Severity:
High (Remote Code Execution)

Vendor:
Yahoo!, Inc.

Systems Affected:
Yahoo Messenger 8 for Windows

Overview:
eEye Digital Security has discovered two critical vulnerabilities in
ywcupl.dll (version 2.0.1.4) and ywcvwr.dll (version 2.0.1.4) included
by default in all releases of Yahoo! Messenger 8.x.  Ywcupl.dll is
Yahoo's Webcam Upload ActiveX Control used by Yahoo! Messenger to stream
content from a user's webcam to other users.  Ywcvwr.dll is Yahoo!
Messenger's Webcam Viewer ActiveX Control used to view any streamed
content.  These files are normally used only when viewing or streaming
webcam content to and from Yahoo Messenger, but they are incorrectly
marked safe for scripting and can be instantiated by any website.
Furthermore they both fail to perform bounds checking on variables
resulting in 2 stack-based buffer overflow conditions that could allow
arbitrary code to execute in the context of the logged-in user. 

The vulnerability is a simple strcpy-based stack buffer overflow within
the ActiveX controls, and can be reliably exploited on all versions of
Windows in order to execute arbitrary code.

Technical Details:
The code for both vulnerabilities is similar, in which they both call
mbscpy on the vulnerable string after allocating only 1023 bytes of
space.


	03ada506	or	dword ptr [ebp-4],0FFFFFFFFh
	03ada50a 	cmp	eax,ebx
	03ada50c 	mov	dword ptr [esi+210h],eax  
	03ada512 	je	ywcupl+0xa5f4 
	03ada518 	lea 	ecx,[esi+174h]
; Loads the payload into ECX
	03ada51e 	call	dword ptr
[ywcupl!DllUnregisterServer+0x4b44
	7c3a44b3 	cmp	dword ptr [ecx+18h],10h
	7c3a44b7 	jb	MSVCP71!std::basic_string
<char,std::char_traits<char>,std::allocator<char>>::_Myptr+0xa
(7c3a44bd)
	7c3a44b9 	mov 	eax,dword ptr [ecx+4]
; Payload is in EAX
	7c3a44bc	ret
	03ada524	push	eax
; push payload to the stack
	03ada525 	push  3FFh
; Max size of 1023		
	03ada52a 	lea   eax,[ebp-414h]
; EAX = 159dfb98 
	
; (Destination buffer Location)
	03ada530 	push	eax

	03ada531	push  offset ywcupl!DllUnregisterServer+0x6498;
"WebcamServer" gets 
	
; pushed on the stack
	03ada536 	lea  	ecx,[esi+0F8h]
; ECX loads payload
	03ada53c 	call  ywcupl+0x4a72
	....
	03ad4ac1 	push 	dword ptr [ebp+14h]
; pushes our payload to the stack
	03ad4ac4 	push  dword ptr [ebp+0Ch]
; pushes 0x159dfb98 
	
; (Destination Buffer to copy payload)
	03ad4ac7 	call 	ywcupl!DllUnregisterServer+0x28f2
(03aebfa6)
	03aebfa6 	jmp   dword ptr
[ywcupl!DllUnregisterServer+0x4b9c]	; Call MSVCR71!mbscpy 



At this point either of the vulnerable ActiveX controls call mbscpy
without bounds checking the 'server' string variable. If this variable
is excessively large it causes a page boundary access violation upon
reaching the bottom of the stack.

After hitting a page boundary the exception handler gets called and
attempts to clean up the access violation.  Since the stack has been
overflowed with a payload, the exception handler loads the payload and
calls it in the following code:  


	7c9037ae 	push 	dword ptr [ebp+14h]
	7c9037b1 	push  dword ptr [ebp+10h]
	7c9037b4 	push	dword ptr [ebp+0Ch]
	7c9037b7 	push  dword ptr [ebp+8]
	7c9037ba	mov   ecx,dword ptr [ebp+18h]
; ECX loads payload
	7c9037bd 	call  ecx
; Calls payload



Protection:
Retina - Network Security Scanner has been updated to identify this
vulnerability.
Blink - Unified Client Security has proactively protected from this
vulnerability since its discovery.

Vendor Status:
Yahoo! has released a patch for this vulnerability which is available
at:
http://messenger.yahoo.com/security_update.php?id=060707

Credit:
Greg Linares

Related Links:
Retina - Network Security Scanner - Free Trial:
http://www.eeye.com/html/products/retina/download/index.html
Blink - Unified Client Security Personal - Free For Home Use:
http://www.eeye.com/html/products/blink/personal/download/index.html
Blink - Unified Client Security Professional - Free Trial:
http://www.eeye.com/html/products/blink/download/index.html

Greetings:
Terrell Karlsten, Dre, the Super Soeder Bros, Matt, Laurentiu, Richard
D. James, Pikey, Cash, Expanders, Str0ke, William Kurnik, Big Perm,
Dooritto, CSam, Shadow Penguin, and Reverse.  Best of luck to where ever
the winds may take you.

Copyright (c) 1998-2007 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically.  It is not to be edited in any way without express
consent of eEye.  If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert@...e.com for permission.

Disclaimer
The information within this paper may change without notice.  Use of
this information constitutes acceptance for use in an AS IS condition.
There are no warranties, implied or express, with regard to this
information.  In no event shall the author be liable for any direct or
indirect damages whatsoever arising out of or in connection with the use
or spread of this information.  Any use of this information is at the
user's own risk.