full-disclosure - [FD] VBScript RegExpComp::PnodeParse out-of-bounds read details (MSIE 8-11, IIS, CScript.exe/WScript.exe)

Open Source and information security mailing list archives

Message-ID: <ca56e0ad-2320-e94e-fdfb-ef13b8250b2f@nwever.nl>
Date: Tue, 8 Nov 2016 10:23:40 +0100
From: Berend-Jan Wever <berendj@...ver.nl>
To: fulldisclosure@...lists.org, Bugtraq <bugtraq@...urityfocus.com>
Subject: [FD] VBScript RegExpComp::PnodeParse out-of-bounds read details
 (MSIE 8-11, IIS, CScript.exe/WScript.exe)

Throughout November, I plan to release details on vulnerabilities I
found in web-browsers which I've not released before. This is the sixth
entry in that series.

The below information is available in more detail on my blog at
http://blog.skylined.nl/20161108001.html. There you can find a repro
that triggered this issue in addition to the information below.

Follow me on http://twitter.com/berendjanwever for daily browser bugs.

VBScript RegExpComp::PnodeParse out-of-bounds read
==================================================
(The fix and CVE number for this bug are not known)

Synopsis
--------
A specially crafted script can cause the VBScript engine to read data
beyond a memory block for use as a regular expression. An attacker that
is able to run such a script in any application that embeds the VBScript
engine may be able to disclose information stored after this memory
block. This includes all versions of Microsoft Internet Explorer.

Known affected versions, attack vectors and mitigations
-------------------------------------------------------
* vbscript.dll
  The issue is known to have affected versions 5.8.7600.16385 up to
  5.8.9600.16384,   and both the 32- and 64-bit vbscript.dll binaries.
  It may also impact earlier versions as well as later versions as I am
  not sure exactly when the issue was addressed by Microsoft.

* Windows Script Host
  VBScript can be executed in the command line using  cscript.exe/
  wscript.exe. An attacker would need to find a script running on a
  target machine that accepts an attacker supplied regular expression
  and a string, or be able to execute his/her own script. However,
  since the later should already provide an attacker with arbitrary
  code execution, no additional privileges are gained by exploiting
  this vuln.

* Microsoft Internet Explorer
  VBScript can be executed from a web-page; MSIE 8, 9, 10 and 11 were
  tested and are all affected. MSIE 11 requires a META tag to force it
  to render the page as an earlier version, as MSIE 11 attempts to
  deprecate VBScript (but fails, so why bother?).
  An attacker would need to get a target user to open a specially
  crafted web-page. Disabling scripting, particularly VBScript, should
  prevent an attacker from triggering the vulnerable code path.
  Enabling *Enhanced Protected Mode* appears to disable VBScript on my
  systems, but I have been unable to find documentation on-line that
  confirms this is by design.

* Internet Information Server (IIS)
  If Active Server Pages (ASP) are enabled, VBScript can be executed in
  Active Server Pages. An attacker would need to find an asp page that
  accepts an attacker supplied regular expression and a string, or be
  able to inject VBScript into an ASP page in order to trigger the
  vulnerability.

Description
-----------
When a regular expression is used to find matches in a string, it is
first "compiled". During compilation, when a '\' escape character is
encountered, the RegExpComp::PnodeParse function reads the next
character to determine the type of escape sequence. However, if the last
character in a regular expression is a '\' character, the code will read
and use the terminating '\0' character as the second character in the
escape sequence. This causes the code to ignore the end of the string
and continue to compile whatever data is found beyond it as if it was
part of the regular expression.

Time-line
---------
* June 2014*: This vulnerability was found through fuzzing, but I was
  unable to reproduce it outside of my fuzzing framework for unknown
  reasons.
* April 2015: This vulnerability was found through fuzzing again.
* April 2015: This vulnerability was submitted to ZDI.
* May 2015: ZDI rejects the submission.
* November 2016: The issue does not reproduce in the latest build of
  MSIE 11.
* November 2016: Details of this issue are released.

Cheers,

SkyLined

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives