Securax Extension overflow update.

[advisory () SECURAX ORG (Securax)]

=====================================================================
Securax-SA-02                                       Security Advisory
belgian.networking.security                                     Dutch
=====================================================================
Topic:          several programs for Ms windows (all versions)seem to
                contain a "fileextension"-overflow.
Announced:      2000-04-21
Updated:        2000-04-23
Affects:        Ms windows98. And several programs for win in general
=====================================================================

          THE ENTIRE ADVISORY HAS BEEN BASED UPON TRIAL AND ERROR
   RESULTS.  THEREFORE WE CANNOT ENSURE YOU THE INFORMATION BELOW IS
   100% CORRECT.  THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT PRIOR
   NOTICE.

          PLEASE, IF YOU HAPPEN TO FIND MORE INFORMATION CONCERNING
   THE BUG DISCUSSED IN THIS ADVISORY, PLEASE SHARE THIS ON BUQTRAQ.
   THANK YOU,

I. Explorer.exe (and problems in native windows code in general)

  Recently i found a buffer overflow in the windows 98 version of
  explorer.exe. (All other version do not seem to be vulnerable.)

  The buffer overflow occurs when you try to highlight a filename
  that contains more than 129 chars in its extension.
  Keeping the cursor above the filename will cause the same results.
  Bugtraq reader Markus kern (markus-kern () GMX NET) suggest this might
  be a problem in the little tool tip window that shows the whole
  filename when the mouse is moved over a file which's name is to
  long to be entirely displayed.

  If the extension contains an even bigger amount of chars (there is
  room for up to 247 or so (in NT for 240), you can overwrite the EIP.

  Doing so should give you something like this.

        EXPLORER caused an invalid page fault in
        module <unknown> at 0000:61616161.
          Registers:
          EAX=61616161 CS=0187 EIP=61616161 EFLGS=00010246
          EBX=80070032 SS=018f ESP=01a1d8fc EBP=61616161
          ECX=c16b6f10 DS=018f ESI=01d0bd3c FS=5047
          EDX=81724974 ES=018f EDI=7fcbd320 GS=0000
          Bytes at CS:EIP:

        Stack dump:
          61616161 61616161 61616161 61616161 61616161 61616161
        61616161 61616161 61616161 61616161 61616161 61616161
        61616161 61616161 61616161 61616161

  I also noticed that if you play around with ascii codes in the
  extension, you can make windows think the file is write protected
  or in use, thus you will not be able to delete the file.
  (Not even in DOS, where you will get a "file not found". file is
  not removed at the moment of writing :-(

  On other versions of windows, the buffer overflow in explorer.exe
  does NOT occur, this does not mean that there are no other problems
  with those long extensions.

  On vuln-dev, John Swensson (john () threebs com) claims that if you use
  a large enough extension, you will not be able to delete the file in
  windows 2000.
  On my NT4, i noticed that several scenarios are possible:
  1) i could delete the file, but i but it never showed up in the
  recycle bin as it is supposed to be.
  2) i could not delete the file, not even after renaming the file to
  something as simple as 1.txt (with errors that depend on the actual
  length of the filename... i saw over 4 different versions of error
  reports while trying to delete the file, however with cmd.exe, i
  could remove the 1.txt file succesfully.)

  A batch file to create such a filename could look like:

---
ECHO Buffer overflow in windows98 explorer.exe
dir *.* >
a.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaa
ECHO you can vary the amount of a's between 129 and 147 +/-.
ECHO try to vary this length, it will change results
---

  the beginning of some exploit code for this problem was published
  on vuln-dev by Laurent eschenauer <laurent.e () mail com>
  and should be available for download pretty soon on
  http://www.securax.org/data/longext-exploit.c
  (not yet available at the moment of writing.)

II.  Buffer overflows in other non Microsoft programs.

        tested: (please help me expanding this list)
        WS_ftp : vulnerable
        Eudora Pro 4.2: vulnerable : Visual C++ (NT4-w98)
        mIRC 5.7: not vulnerable : Borland C++ (NT4)
        frontpage : crashes (NT4)
        codewarrior: not vulnerable (NT4)
        outlook express 5: not vulnerable (win2k)
        windows commander's FTP: vulnerable on download (NT4)
        windows commander's FTP: NOT vulnerable; on UPload (NT4)
        cuteFTP3 : not vulnerable (win98)
        outlook 2000 (win2k)
        
  When looking for a way to remotely exploit this bug, i tried to
  e-mail myself such a file as an attachement.
  When i wanted to download the new message, my Eudora pro suddenly
  crashed with a buffer overflow. (in win98).

        EUDORA caused an invalid page fault in
        module EUDORA.EXE at 0187:00428b05.
        Registers:
        EAX=007f0394 CS=0187 EIP=00428b05 EFLGS=00010206
        EBX=00000000 SS=018f ESP=007eff88 EBP=007f0764
        ECX=006a305c DS=018f ESI=007f07a8 FS=582f
        EDX=007eff8c ES=018f EDI=8173b024 GS=0000
        Bytes at CS:EIP:
        56 50 51 52 ff 15 50 9f 63 00 8b 15 80 2c 6b 00
        Stack dump:

  I noticed that the amount of chars needed to make eudora crash is
  higher then the amount of code needed to crash the win98 explorer.

        note: every time you try to access the dir where the
        attachement should have been saved, your program will crash,
        even if this program is not using explorer for it's file
        management. (In this case you don't even have to click on the
        file or move over it and wait some time, it will crash
        immediately, rendering the entire directory useless.)
        (i think it writes some invisible error in the FAT)

        This is what i got in Windows Commander while trying to
        browse the directory. Note: the file doesn't show up in a
        listing, nevertheless, windows commander crashes with :

        Application Error
        Exception EAccessViolation in module WINCMD32.EXE at 7F8B0736
        Access violation at address 7FCB1946. Read of address 00580939

        Scanning this dir with scandisk does not report any problems.

  When i tried this mail sending some later on my NT, i noticed that
  my Eudora Pro crashed on NT too, popping up Dr. Watson.

  I also got a reply from someone stating that WS_ftp crashes while
  trying to access a directory that contains such filenames.

  I tried uploading and downloading such a file myself with windows
  commander and i noticed that the uploading went ok, but the download
  caused a buffer overflow.

  This raises my suspicion that the problem could be located in the
  I/O library of some version of some popular programming language
  (could somebody check this out ?)
  Please keep sending me reports on vulnerable programs.
  (be sure to check them with the maximum amount of chars available
  on your platform.)

III. Impact

  This type of attack will allow any user local or remote with
  file creation access to run hostile code on the computer.

  If someone writes some tiny code that will download and execute
  a remote trojan, this could cause a huge problem!.
  This could be used to gain "root" access to many windows computers

  Writing such a code might be tricky, coz we are handling with a
  filename, and not all hex codes are accepted as a legal filename.
  (this could be partially circumvented by creating the filename
  with a raw write to disk.)

  Some exploiting hints: remember that you could also place some
  bytes in the file  itself, thus raising the initial amount of
  bytes from +/- 100  to virtually unlimited... i think this means
  that there is no need for an external download.

  Also note that you could use some encryption scheme to bypass
  the limitations in the choice of filename characters.

IV.  Solution

  none yet.
  just don't download extremely long filenames when you can.
  disable auto download of attachements if supported in your
  e-mail program.

V.   Credits

  Initial bug report : |ncubus -*- overflow detection + usage concepts
  + quickly written advisory by Zoa_Chien -*- Exploit shell-code :
  Laurent eschenauer <laurent.e () mail com> -*- Testers: Lamagra
  / nostalg1c / pathos / segfau|t -*- bug by microsoft -*- thnx to all vuln-dev
  replyers.. keep those replies coming !.

Final Notes: I discovered this while working on my soon to be released
tutorial: "Locally Hacking MS-Windows" if anyone has rare information
on this subject, feel free to mail me.

Yours,

Zoa_Chien,                              zoa_chien () iname com

=====================================================================
For more information                             advisory () securax org
Website                                        http://www.securax.org
Advisories/Text                           http://www.securax.org/pers
---------------------------------------------------------------------