Just so that I understand correctly, are you reporting that if one is logged on as the administrator, it may be possible to execute this exploit in order to take over the machine? t -----Original Message----- From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx [mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of J. Oquendo Sent: Friday, April 01, 2011 10:52 AM To: bugtraq@xxxxxxxxxxxxxxxxx Cc: full-disclosure@xxxxxxxxxxxxxxxxx Subject: [Full-disclosure] Microsoft VISTA TCP/IP heap buffer underflow -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Microsoft VISTA TCP/IP heap buffer underflow Summary - ----------------------------- Microsoft Device IO Control wrapped by an API shipping with Windows Vista 32 bit and 64 bit contains a possibly exploitable, buffer underflow corrupting kernel memory. Affected Systems - ----------------------------- Using the sample proof of concept, it was possible to verify this issue on following operating systems and configurations: * Microsoft Windows Vista Ultimate 32 bit It is very likely that other versions of Windows Vista are affected by this issue. This issue did not occur on Windows XP, Windows 2003 Advanced Server, Windows 2008 Server nor Windows Millenium Edition Re-installation of Service Pack 1 and/or upgrading to SP2 had any effect in regards to resolve the random crashes. To execute either the sample program or any other system command, the user has to be either the admin, in the admin group or the Administrators group. Since this buffer underflow never makes it to kernel memory, it could be possible that propping up the underflow will make it overflow and take control over the operating system without any restriction. Remedy - ------------ No remedy available at this time. Reported - ------------ This vulnerability is being reported now Relevant - ------------ 934b7a5c 85aa6fe4 00000000 934b7ac4 837100ee tcpip!IppCreateUnicastRoute+0xf0 934b7ae8 85a5d121 00000001 858b6278 84d74ce8 tcpip!IppValidateSetAllRouteParameters+0x217 934b7b64 85a18a29 836c134c 00000000 92a84a70 tcpip!Ipv4SetAllRouteParameters+0x1d1 934b7ba4 8a844551 00000001 92a326b4 00000000 NETIO!NsiSetAllParametersEx+0xbd 934b7bf0 8a844eb8 00000000 836c1330 836c1378 nsiproxy!NsippSetAllParameters+0x1b1 934b7c14 8a844f91 92a32601 00000000 8371d290 nsiproxy!NsippDispatchDeviceControl+0x88 934b7c2c 818f0053 8590b448 92a32698 92a32698 nsiproxy!NsippDispatch+0x33 934b7c44 81a80515 8371d290 92a32698 92a32708 nt!IofCallDriver+0x63 934b7c64 81a80cba 8590b448 8371d290 0027f700 nt!IopSynchronousServiceTail+0x1d9 934b7d00 81a6a98e 8590b448 92a32698 00000000 nt!IopXxxControlFile+0x6b7 934b7d34 8188ba7a 00000044 00000048 00000000 nt!NtDeviceIoControlFile+0x2a 934b7d34 77529a94 00000044 00000048 00000000 nt!KiFastCallEntry+0x12a 0027f68c 77528444 777214b9 00000044 00000048 ntdll!KiFastSystemCallRet 0027f690 777214b9 00000044 00000048 00000000 ntdll!ZwDeviceIoControlFile+0xc ======== Disassembly with commands ======== mov edi,edi push ebp mov ebp,esp push edi mov edi,dword ptr [ebp+8] lea eax,[ebp+8] push eax push dword ptr [edi+4] push 18h call NOMNOM!RtlULongAdd (85a1675d) test eax,eax jl OMNOM!PtpCreateNOM+0x1b push esi push 74704D4Eh push dword ptr [ebp+8] ; = 0x00000020 push 0 call ExAllocatePoolWithTag ; eax = ExAllocatePoolWithTag(0, 0x20, 0x74704D4E, esi); mov esi,eax ; = 0x83716380 allocated buffer address test esi,esi je NOM!CreateOMNOM+0x6d push dword ptr [ebp+8] ; = 0x00000020 push 0 push esi ; 0x83716380 allocated buffer address call NOM!memset (85a10543) ; memset((char*)0x83716380, 0, 0x20) mov eax,dword ptr [ebp+14h] mov dword ptr [esi],eax mov eax,dword ptr [ebp+18h] mov dword ptr [esi+0Ch],eax mov dword ptr [eax],esi mov eax,dword ptr [ebp+0Ch] and word ptr [esi+14h],0 add esp,0Ch push eax ; = 0x837100ee lea eax,[esi+18h] ; esi unchanged, holds the alloc. buffer address (=0x83716380) push eax ; = 0x83716398 add offset of 0x18 bytes to the allocated buffer inc dword ptr [edi+8] mov eax,esi pop esi pop edi pop ebp ret 14h nop nop nop om nom nom - -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iD8DBQFNlhDEK/fYPyEKla8RAnWXAJ0XaB/D0Cd0eYt+6Vd00Tx6RYsRmQCfWwGk QGt6mpCUiDKXxhCdg5xpi7M= =pjws -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
