bugtraq - Security vulnerability in BufferZone 2.5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070824222420.11582.qmail@securityfocus.com>
Date: 24 Aug 2007 22:24:20 -0000
From: seppi@...pig.de
To: bugtraq@...urityfocus.com
Subject: Security vulnerability in BufferZone 2.5

vulnerable software: BufferZone (all product version) till version 2.5 (latest)
type of vulnerability: DoS, potential privilege escalation

I found a vulnerability in BufferZone which allows an unprivileged user and even a malicious software running inside the BufferZone sandbox to crash the system and potentially run arbitrary code with kernel privileges.
The issue is within the kernel driver redlight.sys which does not properly validate file buffer. Sending the IOCTL code FsSetVolumeInformation with subcode FsSetDirectoryInformation with a large buffer but underreporting its size with at most 1024 bytes results in a buffer underrun which might also lead to executing arbitrary code.
Since the RedLight device is also visible to sandboxed application, it might allow a sandboxed malware to escape the sandbox.

How to reproduce:
- get DC2.exe from the latest Windows Driver Kit
- install BufferZone
- login with an unprivileged user
- start a cmd.exe shell within the sandbox
- run "dc2 /hct \Device\RedLight"

I have originally reported this vulnerability for BufferZone 2.1 on 13-Jun-07, but aside from an some auto-response mails never received any reply. The vulnerability is still present in the most recent version 2.5.