Message-Id: <1C3BD508-6F50-4339-B235-A7DB308524F1@tippingpoint.com>
Date: Wed, 16 Jan 2008 14:12:32 -0600
From: DVLabs <dvlabs@...pingpoint.com>
To: full-disclosure@...ts.grok.org.uk,
 bugtraq@...urityfocus.com
Cc: dvlabs@...pingpoint.com
Subject: TPTI-08-02: Cisco Call Manager CTLProvider Heap
	Overflow Vulnerability

TPTI-08-02: Cisco Call Manager CTLProvider Heap Overflow Vulnerability
http://dvlabs.tippingpoint.com/advisory/TPTI-08-02
January 16, 2008

-- CVE ID:
CVE-2008-0027

-- Affected Vendor:
Cisco

-- Affected Products:
Cisco Call Manager 4.1(3)

-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Cisco CallManager. Authentication is not
required to exploit this vulnerability.

The specific flaw exists within the CTL Provider Service,
CTLProvider.exe, which binds to TCP port 2444. The service operates
over a SSL encrypted transport.  Due to a logic flaw in the way data is
received in a loop a heap allocation can be arbitrarily overflown
resulting in the control of subsequent heap chunks.  This can lead to
arbitrary code execution.

The vulnerability is due to a loop that occurs during receive of socket
data.  An initial buffer is allocated at 0x19000 bytes, as can bee seen
here.

.text:00406077 191A8 68+      push    19000h
; size_t
.text:0040607C 191AC FF+      call    ds:__imp_malloc
.text:00406082 191AC 83+      add     esp, 10h
.text:00406085 1919C 89+      mov     [edi+14h], eax
.text:00406088 1919C 85+      test    eax, eax
.text:0040608A 1919C 0F+      jz      loc_406238

Once allocated data is read in 0x19000 chunks.  If more than 0x4000
bytes of data are left on the socket we loop again as can be seen
here.

.text:004060A5 191AC FF+      push    dword ptr [ebp-14h]
; size_t
.text:004060A8 191B0 8D+      lea     eax, [ebp-1919Ch]
.text:004060AE 191B0 50       push    eax
; void *
.text:004060AF 191B4 8B+      mov     eax, [edi+14h]
.text:004060B2 191B4 03+      add     eax, [ebp-1Ch]
.text:004060B5 191B4 50       push    eax
; void *
.text:004060B6 191B8 E8+      call    memcpy
.text:004060B6 191B8 2F+
.text:004060BB 191B8 B8+      mov     eax, 16384
.text:004060C0 191B8 83+      add     esp, 1Ch
.text:004060C3 1919C 39+      cmp     [ebp-14h], eax
.text:004060C6 1919C 75+      jnz     short loc_4060F8

.text:004060C8 1919C 50       push    eax
; int
.text:004060C9 191A0 68+      push    offset str__ErrDExceeds16k
; 'err %d exceeds 16K'
.text:004060CE 191A4 8D+      lea     eax, [ebp-88h]
.text:004060D4 191A4 68+      push    80000h
; int
.text:004060D9 191A8 50       push    eax
; int
.text:004060DA 191AC E8+      call    log_message
.text:004060DA 191AC B7+
.text:004060DF 191AC 83+      add     esp, 10h
.text:004060E2 1919C 81+      add     dword ptr [ebp-1Ch], 4000h
.text:004060E9 1919C 68+      push    offset
str__MaybeThereIsMoreData__readAgain ; "Maybe there is more data..Read
again"
.text:004060EE 191A0 68+      push    10000h
.text:004060F3 191A4 E9+      jmp     loc_405FFF

This will continue until heap chunks are overwritten at the users
control, which can be exploited to overwrite memory and further lead to
arbitrary code execution.

-- Vendor Response:
http://www.cisco.com/warp/public/707/cisco-sa-20080116-cucmctl.shtml

-- Disclosure Timeline:
2007.06.04 - Vulnerability reported to vendor
2008.01.16 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by Cody Pierce - TippingPoint DVLabs.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists