bugtraq - Securstar - DriveCrypt - Local Kernel Denial of Service/Memory Disclosure/Privilege Escalation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4E272C0C.7080804@digit-security.com>
Date: Wed, 20 Jul 2011 20:27:08 +0100
From: Digit Security Research <research@...it-security.com>
To: full-disclosure@...ts.grok.org.uk
CC: bugtraq@...urityfocus.com
Subject: Securstar - DriveCrypt - Local Kernel Denial of Service/Memory Disclosure/Privilege
 Escalation

===============================ADVISORY===============================
Advisory:          Securstar - DriveCrypt - Local Kernel
                   Denial of Service/Memory Disclosure/Privilege Escalation
Advisory ID:       DSEC-2011-0001
Author:            Neil Kettle, Digit Security Ltd
Affected Software: Securstar DriveCrypt
Vendor URL:        http://www.securstar.com
Vendor Status:     'patched'
Category:          Denial of Service/Memory Disclosure/Privilege
                   Escalation
Date Reported:     2009/12/07
Last Modified:     2011/07/20
Release Date:      2011/07/20
===============================ADVISORY===============================

Description
-----------
Multiple vulnerabilities have been discovered in Securstar DriveCrypt kernel
drivers, the vulnerabilities exist due to several somewhat systemic issues in
the validation of user-supplied pointers and trust thereof, use of user-supplied
parameters to privileged kernel functionality and finally, the lack of bounds
checking in unbounded copy operations resulting in buffer overflows.

Analysis
--------
Numerous vulnerabilities exists due to a complete lack of validation of user- 
supplied pointers contained within structures passed as arguments to the IOCTL 
interface exported from the globally accessible "\\.\DCR" device.

Exploitation
------------
An exploit will be made available to the public in due course at the
following URL,

  http://www.digit-labs.org/
  http://www.digit-security.com/research.php

Technologies Affected
------------------------------
Securstar - DriveCrypt (<= 5.2)


Vendor Response
------------------------------
http://www.securstar.com/press.php?id_press=405


Disclosure Timeline
------------------------------
7th December 2009 - Vendor Disclosure
10th June 2011 - Vendor Releases Patches


Credits
------------------------------
Neil Kettle of Digit Security Ltd


About Digit Security Ltd
----------------------------------
Digit Security is a computer security consultancy based in the United
Kingdom, albeit with a slight difference. The company is a co-operatively
controlled entity comprised of professionals who are experts in their
respective fields. Thus, as a corollary, nearly everyone at Digit Security
is a both a Consultant, Developer and a Director.

Web:        www.digit-security.com
Email:      research@...it-security.com