Message-ID: <47C2E7B5.2000107@coresecurity.com>
Date: Mon, 25 Feb 2008 14:07:17 -0200
From: Core Security Technologies Advisories <advisories@...esecurity.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	vulnwatch@...nwatch.org
Subject: CORE-2007-0930 Path Traversal vulnerability in VMware's shared folders
 implementation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


~      Core Security Technologies - CoreLabs Advisory
~           http://www.coresecurity.com/corelabs

Path Traversal vulnerability in VMware's shared folders implementation

*Advisory Information*

Title: Path Traversal vulnerability in VMware's shared folders implementation
Advisory ID: CORE-2007-0930
Advisory URL: http://www.coresecurity.com/?action=item&id=2129
Date published: 2008-02-25
Date of last update: 2008-02-25
Vendors contacted: VMware Inc.
Release mode: User release

*Vulnerability Information*

Class: Input Validation Error
Remotely Exploitable: Yes
Locally Exploitable: Yes
Client-side Exploitable: No
Bugtraq ID: 27944
CVE Name: CVE-2008-0923

*Vulnerability Description*

Software from VMWare Inc. allows users to run an entire computer system
composed of hardware, OS and applications within a virtualized environment
isolated from the real hardware resources and the computer system that
controls them. Virtualization technologies such as VMware's increase
efficiency in the use of hardware and help to reduce operational costs
through consolidation of servers and desktop system running on fewer and
more maintainable hardware systems.

Among the many reasons that promote the adoption virtualization
technologies, one of the most commons today is the promise of an improved
information security posture due to the implied isolation between multiple
virtualized systems (referred as Guest systems) and the non-virtualized
systems controlling the virtualization hardware and software (the Host
system) [1].

Consequently, software bugs that could allow potential attackers to
invalidate the premise of effective isolation between Host and Guest
systems are considered security vulnerabilities with a potentially high
impact. Attacks to exploit these type of vulnerabilities has been
discussed on several public forums [2][3]. To maintain and improve user
inter-operation with virtualized and non-virtualized systems VMware's
software implements a number of inter-system communication features. The
Shared Folder mechanism is one of such features and is enabled by default
in all VMware's products that provide it.

VMware's shared folders allow users to transfer data between a virtualized
system (Guest) and the non-virtualized Host system that contains it. This
form of data transfer is available to users of the Guest system through
read and write access to file system folders shared by both Guest and Host
system. To maintain effective isolation between Guest and Host systems,
these mechanisms should limit access from the Guest only to the Host
system's folders that are selected for sharing with the virtualized guests.

A vulnerability was found in VMware's shared folders mechanism that grants
users of a Guest system read and write access to any portion of the Host's
file system including the system folder and other security-sensitive
files. Exploitation of these vulnerability allows attackers to break out
of an isolated Guest system to compromise the underlying Host system that
controls it.

Successful exploitation requires that the Shared Folder's feature to be
enabled which is the default on VMware products that have the feature AND
at least one folder of the Host system is configured for sharing.

*Vulnerable Packages*

. VMWare Workstation 6.0.2
. VMWare Workstation 5.5.4
. VMWare Player 2.0.2
. VMWare Player 1.0.4
. VMWare ACE 2.0.2
. VMWare ACE 1.0.2

*Non-vulnerable Packages*

. VMWare ESX
. VMWare Server

*Vendor Information, Solutions and Workarounds*

Disable the Shared Folders feature for all virtual machines. On VMWare
Workstation this can be done by clicking on "Edit virtual machine
settings" and disabling shared folders in the Options tab.

The vendor has published a security alert with a setp-by-step description
of how to disable Shared Folders on affected products.

*Critical VMware Security Alert for Windows-Hosted VMware Workstation,
VMware Player, and VMware ACE*
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1004034

*Credits*

This vulnerability was discovered by Gerardo Richarte while developing an
exploit for vulnerability CVE-2007-1744. The final exploit for both
vulnerabilities was developed by Nicolas Economou, both of them from CORE
IMPACT's Exploit Writing Team (EWT), Core Security Technologies.

*Technical Description / Proof of Concept Code*

While developing an exploit for the CVE-2007-1744 vulnerability [4] the
root cause of the original bug was identified in the way that the
'PathName' parameter is processed by the VMware API that provides the
Shared Folders functionality in the Guest operating system.

The 'PathName' parameter is converted from a multi byte string to a wide
character string after verifying that it doesn't contain the dot-dot
substring (the two-byte sequence '0x2e0x2e' that translates to the ASCII
substring '".."') that may allow a malicious user to break out of the
shared folder using a path traversal attack. The resulting wide character
string converted from 'PathName' is then passed to the file system API on
the Host system.

The conversion is performed using the 'MultiByteToWideChar' function from
the Windows API [5] which maps a character string provided as input to a
wide (Unicode UTF-16) character string.

The call of 'MultiByteToWideChar' to map the 'PathName' to Unicode UTF-16
specifies that the UTF-8 CodePage should be used for the conversion. Since
validation of the input to remove the dot-dot substring is performed
before the input string is converted a malicious program or user on the
Guest system could provide a 'PathName' that passes this validation
process but still gets mapped to a string containing the Unicode UTF-16
version of the dot-dot- substring after the call to 'MultiByteToWideChar'.

A UTF-8 byte sequence that translates to said dot-dot substring is
'%c0%2e%c0%2e'. This sequence is well-known among web application
penetration testers that use regularly to attempt to escape the root
document folder of a web application prone to path traversal
vulnerabilities. Although the above byte sequence is not in valid UTF-8
encoding a call to the 'MultiByteToWideChar' function that does not set
the second argument ('dwFlags') to 'MB_ERR_INVALID_CHARS' will simply
ignore and discard any invalid characters on input and map the rest to
Unicode output .

Prior to CVE-2007-1744 the call to 'MultiByteToWideChar' was . performed
with a 'dwFlags' argument set to 0, thus allowing an attacker to pass
invalid UTF-8 input that would pass the verification process and get
translated by 'MultiBytetoChar' to a string that includes the dot-dot
substring .

The fix to CVE-2007-1744 [6] consisted in setting the
'MB_ERR_INVALID_CHARS' flag to the function call thus making it fail
(setting the error code to 'ERROR_NO_UNICODE_TRANSLATION') if non-valid
UTF-8 input was provided.

However, since the inspection of input looking for the evil dot-dot
substring remained a step prior to its mapping to Unicode UTF-16 the basic
execution flow for a potential attack did not change. After the fix for
CVE-2007-1744 an attacker would only need a way to provide a valid UTF-8
string that passes input sanitization AND the call to 'MultiByteToChar'
but still yield an string that contains the malicious dot-dot substring
after the mapping.

When we originally found this, we were not sure if it was possible to pass
the call to 'MultiByteToWideChar' with the 'MB_ERR_INVALID CHARS' flag set
but research continued due to the belief that the patch was not
necessarily correct since we thought that proper filtering had to be done
only after all the translations of the input were completed and prior to
passing the results to the Host's system file system layer.

Although we live in a ISO 8851-1 Latin 1 (28591) codepage-speaking country
we don't really know the deepest secret internals of UTF-8 , multi-byte
strings and Unicode conversions. Thus we developed a small program that
reproduces how vmware-vmx.exe calls 'MultiByteToWideChar()' to find out
whether it is possible or not to build a valid UTF-8 sequence that maps to
an Unicode string with the evil dot-dot substring '_.._ '

The C code for such program is provided below

/-----------

// mbtwc.c
#include <windows.h>;
int main(int argv, char *argc[]) {
~    unsigned int i, ans;
~    unsigned char buf[200];
~    for (i=1;i;i++) {
~        memset(buf, 0, 200);
~        ans = MultiByteToWideChar(CP_UTF8, 8, &i, 4, buf, 100);
~        // 8 = MB_ERR_INVALID_CHARS
~        if (ans && (buf[0] == '.') &&	(buf[1] == 0) &&
~            ((i & 0xff) != '.'))
~           printf("%d %04x: %02x %02x %02x %02x\n", ans, i,
~                   buf[0], buf[1], buf[2], buf[3]);
	 }
~ }
- -----------/

The program found several UTF-8 byte sequences that traslate to a dot-dot
substring after the call to 'MutliByteToWideChar', the first one of them
being '"0xc20x2e0xc20x2e_'.

In order to develop test tools and the final exploit we used the wonderful
information and tools released at the VM Back project [7]by Ken Kato and
other contributors. Using the project's VMFtp tool with a few
modifications it is trivial to produce a working exploit. Our approach for
a proof-of-concept test was to modify VMFtp's source code to replace all
occurrences of ''+'' with ''\xc2'' in an input pathname.

After doing the above, the following command on a modified VMFtp client
list the contents of the root directory of the Host's file system and then
uploads a file from the Guest system to the root directory of the Host system.

/-----------

cd existing_share
ls +.+./+.+./+.+./+.+./+.+./+.+./
put myboot.ini +.+./+.+./+.+./+.+./+.+./+.+./+.+./+.+./boot.ini

- -----------/



Additionally, we tried to find out whether it's possible or not to exploit
this bug when no shared folders are configured but the Shared Folders
feature is enabled (as in a default installation). Due to what we believe
is an early check in the implementation to verify if the linked list of
existing shares is empty or not, we think that this bug is not exploitable
when no folders are configured as shared, however, we wouldn't be
surprised if other execution paths that allow exploitation bypassing this
early check are found. Consequently, we suggest that you update to a fixed
version, even if no folders are shared for your configurations. If this is
not a possibility, we suggest that you at least disable the Shared Folders
feature, which, as we said, is enabled by default.

Additional Information

Here we present the minimum modifications to VMFtp from the VMBack project
to build something that will help you demonstrate the importance of the
bug, verify if the your boxes are patched or not, and if the official
patch actually patched the vulnerability.

Modifications to the file vmw/src/vmshf.c:

/-----------

static void ReplaceDelim(char *str, uint32_t length, char delim)
{
~   while (length--) {
~   if (*(str + length) == '\0' || *(str + length) == '/' ||
~       *(str + length) == '\\') {

~        *(str + length) = delim;
~      }
~      if (*(str + length) == '+') *(str + length) = '\xc2';
~   }
~ }
- -----------/

VMWare released the source code for their VMWare tools [8]which could
allow to implement the same functionality by modifying	the source code of
official VMWare tools.


*Report Timeline*

. *2007-10-16*:  Initial contact email sent to the VMware Security Team
notifying discovery of a Priority 1 vulnerability in accordance to the
vendor's security policy [9]. A draft security advisory describing the
problem is available. Public disclosure of the vulnerability is scheduled
on November 5th, 2007.
. *2007-10-17*:  Vendor acknowledges notification, provides public key and
requests a draft of the security advisory .
. *2007-10-17*:  Core sends the draft advisory.
. *2007-10-19*:  Vendor indicates it will be able to address the issue in
a release planned for December.
. *2007-10-29*:  Core requests an status update since there has been no
communication since October, 17th, 2007. Vendor indicates it will be able
to address the issue in a release planned for December, this information
was already provided to Core on October 19th 2007 on a personal email
exchange. The December release is likely to be move to the first week of
January 2008.
. *2007-10-29*:  Core confirms that the December target was communicated
on October 19th, 2007.
. *2007-11-26*:  Core requests an status update, asking if the vendor is
still on track to release fixes in December 2007 and on which specific date.
. *2007-11-26*:  Vendor communicates that normally the release would be on
December 27th, 2007 but since that date is in the middle of most people's
holiday the release will be postponed to January. A specific date has not
been set.
. *2008-01-07*:  Core requests and status update since there has been no
communication since November 26th, 2007. Core asks if the vendor is on
track to release fixes on the second week of January 2008. VMware had
released of a new version of its VI product line in December but had not
indicate if this release included fixed versions of the vulnerable VMware
products. Publication of CORE-2007-0930 has been re-scheduled for January
14th, 2007.
. *2008-01-08*:  Vendor communicates that none of the updates	released in
December 2007 addressed the vulnerability reported by Core and provided an
official list of supported product that are vulnerable and their
respective versions. Vendor cannot commit to a specific date for the
release of fixes but can commit to	release a fix within the first quarter
of the year (Q1/2008). The upcoming release of minor version updates of
vulnerable product is scheduled for February 14th.
. *2008-01-08*:  Email reply from Core indicating that publication of
CORE-2007-0930 has been re-scheduled to February 14th., 2008. Nonetheless,
the lack of vendor commitment to a specific date for the release of fixes
does not make the ballpark commitment of Q1/2008 any more credible than
the previous estimations.
. *2008-02-06*:  Core requests a status update since there has been	no
communication since January 8th, 2008. Core requests confirmation that
VMware Server is not affected and asks if the vendor is on track to
release fixes on February 14th. 2008 or on any other specific date within
the first quarter of the year. In case that February 14th. 2008 was deemed
not longer viable, Core will need notification by COB Monday January 11th,
2008.
. *2008-02-08*:  Vendor response indicating that the release of new	minor
version updates to a subset of vulnerable supported products have been
delayed and is now scheduled for February 24th., 2008. Minor version
updates to another subset of the vulnerable products is planned for March
15th, 2008. VMware Server is confirmed not-vulnerable since it does not
provide Shared Folders functionality (HGFS).
. *2008-02-08*:  Core indicates that in view of the status update received
from the vendor, publication of CORE-2007-0930 has been re-scheduled for
Feb. 25th.	2008, this new date is still subject to change if and only if;
i) Vendor confirms by Feb 13th. that the upcoming product releases planned
for Feb. 25th. will indeed fix the bug. ii) Vendor commits by Feb. 13th.
to a fix release date for the remaining set of affected products. iii)
Vendor communicates any change to the Feb. 25th. release date by COB Feb
20th. and the new release date does not exceed 6 working days from the
currently scheduled date.
. *2008-02-22*: Final draft of CORE-2007-0930 sent to VMware's Product
Security Group. Any additional  information to be included in the advisory
should be received by COB Friday February 22nd.
. *2008-02-25*: CORE-2007-0930 published.

*References*

[1] Top 5 Reasons to Adopt Virtualization Software -
http://www.vmware.com/overview/why.html
[2] "Ghost in the Virtual Machine", IEEE Security and Privacy, vol.5,
no.4, pp.68-71, Jul/Aug, 2007
~    http://doi.ieeecomputersociety.org/10.1109/MSP.2007.83
[3] PaulDotCom Security Weekly - Episode #378
~  http://www.pauldotcom.com/2007/07/31/escaping_from_the_virtualizati.html
[4] iDefense VMware Workstation Shared Folders Directory Traversal
Vulnerability (CVE-2007-1744)
~  http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=521
[5] Microsoft Developer Network: MultiByteToWideChar
~    http://msdn.microsoft.com/library/en-us/intl/unicode_17si.asp
[6] VMware Workstation Release Notes
~    http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html#554
[7] VM Back project
~    http://chitchat.at.infoseek.co.jp/vmware/
[8] Open Virtual Machine Tools
~    http://open-vm-tools.sf.net
[9]VMWare Inc. Security Response Policy
~   http://www.vmware.com/support/policies/security_response.html

*About CoreLabs*

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important areas
of computer security including system vulnerabilities, cyber attack
planning and simulation, source code auditing, and cryptography. Our
results include problem formalization, identification of vulnerabilities,
novel solutions and prototypes for new technologies. CoreLabs regularly
publishes security advisories, technical papers, project information and
shared software tools for public use at:
http://www.coresecurity.com/corelabs/.

*About Core Security Technologies*

Core Security Technologies develops strategic solutions that help
security-conscious organizations worldwide develop and maintain a
proactive process for securing their networks. The company's flagship
product, CORE IMPACT, is the most comprehensive product for performing
enterprise security assurance testing. CORE IMPACT evaluates network,
endpoint and end-user vulnerabilities and identifies what resources are
exposed. It enables organizations to determine if current security
investments are detecting and preventing attacks. Core Security
Technologies augments its leading technology solution with world-class
security consulting services, including penetration testing and software
security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core
Security Technologies can be reached at 617-399-6980 or on the Web at
http://www.coresecurity.com.

*Disclaimer*

The contents of this advisory are copyright (c) 2008 Core Security
Technologies and (c) 2008 CoreLabs, and may be distributed freely provided
that no fee is charged for this distribution and proper credit is given.

*GPG/PGP Keys*

This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFHwue1yNibggitWa0RAqOZAJoDkzrfyfJRPodprshHMvqqRju1QQCgqWmv
NDbMYm9mdftFmDl+9Au/4pA=
=P7zB
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists