full-disclosure - Pre-open files attack agains locked file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <22788661.20070310150426@SECURITY.NNOV.RU>
Date: Sat, 10 Mar 2007 15:04:26 +0300
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Pre-open files attack agains locked file

Hello lists, hello Roger. It's me again.

Sorry  for  annoyance, but there is one more attack vector with pre-open
files I meant, but forgot to mention. It seems dangerous enough and need
to  be  investigated for different applications. It's theoretical attack
against application relying on mandatory locks.

Attack scenario:

1.  Alice pre-opens some Document and awaits Bob to open it. Document is
safe  to open (text file, video file, business application format, etc).
Also, like in case of Microsoft Word it can be temporary file.
2. Bob opens Document with some Application.
3. Application locks file and reads or writes some data
4. Alice modifies data
5. Application  reads  previously  accessed  data.  Because application
relies on the fact data can not be modified in locked file, this data is
not  validated. It can lead to the problems like buffer overflows and to
ability to modify execution flow / arbitrary code execution.

What  can  be  instead  of  Application? Any application to process user
supplied file which locks this file during processing.

Examples are: Microsoft Office applications, video/audio players, etc. I
expect  huge  number of applications are vulnerable and will be grateful
to  everyone  who  can  help  me  to  find  this kind of vulnerabilities
in-the-wild,  because this kind of vulnerability is not trivial and hard
to catch without source code analysis.

-- 
http://securityvulns.com/
         /\_/\
        { , . }     |\
+--oQQo->{ ^ }<-----+ \
|  ZARAZA  U  3APA3A   } You know my name - look up my number (The Beatles)
+-------------o66o--+ /
                    |/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/