full-disclosure - Re: 0-day ANI vulnerability in Microsoft Windows(CVE-2007-0038)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <E4F8FCFF12A98B4C9597295538AD7E4B01D43A34@TYPHOON.ssdcorp.net>
Date: Fri, 30 Mar 2007 20:47:42 -0400
From: "Eric Sites" <erics@...belt-software.com>
To: "Alexander Sotirov" <asotirov@...ermina.com>,
	"Jan Wrobel" <wrobel@...es.ath.cx>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: 0-day ANI vulnerability in Microsoft
	Windows(CVE-2007-0038)

You really need to check for:

RIFF[4 byte file size] <-- The file size can be ignored.
Then the next 4 byte after the file size should contain:
ACON

Then look for:

anih and the 4 byte value following it greater than 0x50, this is the
stack buffer overflow point. New ANIs can be built with any number of
anih chunks and only one of them needs to be larger than 80 bytes
decimal.

Cheers,
Eric Sites, CTO
Sunbelt Software

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of
Alexander Sotirov
Sent: Friday, March 30, 2007 8:29 PM
To: Jan Wrobel
Cc: full-disclosure@...ts.grok.org.uk; bugtraq@...urityfocus.com
Subject: Re: [Full-disclosure] 0-day ANI vulnerability in Microsoft
Windows(CVE-2007-0038)

Jan Wrobel wrote:
> I don't know if this rule detects all possible exploits or just one
> particular type. Here is a Firekeeper version of the rule, which can
> be used to detect sites hosting malicious files:
> 
> alert (msg:"BLEEDING-EDGE CURRENT EVENTS MS ANI exploit";
body_content:"|54 53 49 4C 03 00 00 00 00 00 00 00 54 53 49 4C 04 00 00
00 02 02 02 02 61 6E 69 68 52|";
reference:url,http://isc.sans.org/diary.html?storyid=2534;
reference:url,http://www.avertlabs.com/research/blog/?p=233;
reference:url,doc.bleedingthreats.net/2003519; fid:2003519; rev:1;)

A better way would be to look for all files that start with "RIFF" and
contain
two copies of the string "anih", the first one followed by the dword
0x24, the
second one followed by a dword that's not 0x24. This should detect the
exploitation of the stack overflow with no false negatives. To avoid
false
positives, you'll need code to parse all records in the ANI file and
check for
more an "anih" record with a size not equal to 0x24.

Here's the regexp in Perl (somebody please convert it to a Snort rule)

/^RIFF.*anih\x24\x00\x00\x00.*anih(?!\x24\x00\x00\x00)/

Alex

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/