full-disclosure - Re: [FD] Beginners error: iTunes for Windows runs rogue program C:\Program.exe when opening associated files

Open Source and information security mailing list archives

Message-ID: <A36548D2D4A84B909CC9C94144EBFA4C@celsius>
Date: Tue, 6 May 2014 13:41:12 +0200
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <noloader@...il.com>
Cc: Full Disclosure List <fulldisclosure@...lists.org>,
	BugTraq <bugtraq@...urityfocus.com>
Subject: Re: [FD] Beginners error: iTunes for Windows runs rogue program
	C:\Program.exe when opening associated files

"Jeffrey Walton" <noloader@...il.com> wrote:

>> the current version of iTunes for Windows (and of course older versions
>> too) associates the following vulnerable command lines with some of the
>> supported file types/extensions:
> 
> They also install Bonjour and a couple of other services as NT
> Authorty/SYSTEM, don't drop privileges, and open listening sockets.
> 
> Avoid Apple software on Windows like the plague....

ACK. Unfortunately not all people follow your and my advice...

This poorly crafted plague also creates the following "Run" command lines

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"iCloudServices"="C:\\Program Files (x86)\\Common Files\\Apple\\Internet Services\\iCloudServices.exe"
"ApplePhotoStreams"="C:\\Program Files (x86)\\Common Files\\Apple\\Internet Services\\ApplePhotoStreams.exe"

which run "C:\Program.exe" (and "C:\Program Files.exe" on x64),
"C:\Program Files\Common.exe" (and "C:\Program Files (x86)\Common.exe"
on x64) or "C:\Program Files\Common Files\Apple\Internet.exe" (and
"C:\Program Files (x86)\Common Files\Apple\Internet.exe" on x64) during
user login, and COM resp. "shell" objects

[HKEY_CLASSES_ROOT\CLSID\{81E8B13B-EDEA-FF08-90CB-47D97550AD14}\Shell\Open\Command]
@=expand:"C:\\Program Files (x86)\\Common Files\\Apple\\Internet Services\\iCloud.exe"

[HKEY_CLASSES_ROOT\CLSID\{FF982CA0-9F7A-42D5-82B8-155B74904925}\LocalServer32]
@="C:\\Program Files\\Common Files\\Apple\\Internet Services\\AppleOutlookDAVConfig64.exe"

with still more unquoted command lines.

It's a shame that developers still dont know how to handle pathnames
containing spaces properly and that their QA is sound asleep!

Stefan Kanthak

> On Wed, Apr 30, 2014 at 3:02 PM, Stefan Kanthak <stefan.kanthak@...go.de> wrote:
>> Hi @ll,
>>
>> the current version of iTunes for Windows (and of course older versions
>> too) associates the following vulnerable command lines with some of the
>> supported file types/extensions:
>>
>> daap=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> itls=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> itms=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> itmss=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> itpc=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> itsradio=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> iTunes=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> iTunes.AssocProtocol.daap=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> iTunes.AssocProtocol.itls=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> iTunes.AssocProtocol.itms=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> iTunes.AssocProtocol.itmss=C:\Program Files (x86)\iTunes\iTunes.exe /url"%1"
>> iTunes.AssocProtocol.itpc=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> iTunes.AssocProtocol.pcast=C:\Program Files (x86)\iTunes\iTunes.exe /url"%1"
>> itunesradio=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>> pcast=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
>>
>>
>> The command line registered under
>>
>> [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\iTunes\shell\open\command]
>> @="C:\Program Files\iTunes\iTunes.exe"
>>
>> shows the same beginners error too: an unquoted pathname allows the
>> execution of the rogue programs "C:\Program.exe" or "C:\Program Files.exe"
>> instead of the intended executable.
>>
>>
>> From <http://msdn.microsoft.com/library/cc144175.aspx>
>> or <http://msdn.microsoft.com/library/cc144101.aspx>:
>>
>> | Note: If any element of the command string contains or might contain
>>         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> | spaces, it must be enclosed in quotation marks. Otherwise, if the
>>   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> | element contains a space, it will not parse correctly. For instance,
>> | "My Program.exe" starts the application properly. If you use
>> | My Program.exe without quotation marks, then the system attempts to
>> | launch My with Program.exe as its first command line argument. You
>> | should always use quotation marks with arguments such as "%1" that are
>> | expanded to strings by the Shell, because you cannot be certain that
>> | the string will not contain a space.
>>
>>
>> "Long" filenames containing spaces exist for about 20 years in Windows.
>> It's REALLY time that every developer and every QA engineer knows how
>> to handle them properly.
>>
>>
>> If you detect such silly bugs: report them and get them fixed.
>> If the vendor does not fix them: trash the trash!
>>
>>
>> JFTR: this bugs only exists since Microsoft "masks" it.
>>       See <http://msdn.microsoft.com/library/ms682425.aspx> for this
>>       well-known idiosyncrasy:
>>
>> | For example, consider the string "c:\program files\sub dir\program name".
>> | This string can be interpreted in a number of ways.
>> | The system tries to interpret the possibilities in the following order:
>> | c:\program.exe files\sub dir\program name
>> | c:\program files\sub.exe dir\program name
>> | c:\program files\sub dir\program.exe name
>> | c:\program files\sub dir\program name.exe
>>
>>       Without this kludge this beginners error would get caught upon
>>       the very first use of any of these command lines.
>>
>>
>> Since every user account created during Windows setup has administrative
>> rights every user owning such an account can create the rogue program,
>> resulting in a privilege escalation.
>>
>> JFTR: no, the "user account control" is not a security boundary!
>>
>>
>> regards
>> Stefan Kanthak
>>
>>
>> PS: for static detection of these silly beginners errors download and
>>     run <http://home.arcor.de/skanthak/download/SLOPPY.CMD>
>>
>>     To catch all instances of this beginners error download
>>     <http://home.arcor.de/skanthak/download/SENTINEL.CMD>,
>>     <http://home.arcor.de/skanthak/download/SENTINEL.DLL> and
>>     <http://home.arcor.de/skanthak/download/SENTINEL.EXE>, then read
>>     and run SENTINEL.CMD

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives