This might be of some interest to forensics folks, since some
methodologies advocate read-only mounting and examination of acquired disk
images... it might be not such a wise idea, in general.
---------- Forwarded message ----------
Date: Thu, 17 Mar 2005 22:36:45 +0100 (CET)
Subject: Linux ISO9660 handling flaws
There appears to be a fair number of kernel-level range checking flaws in
ISO9660 filesystem handler (and Rock Ridge / Juliet extensions) in Linux
up to and including 2.6.11. These bugs range from DoS conditions to
potentially exploitable memory corruption - all this whenever a specially
crafted filesystem is mounted or directories are examined.
Most apparent flaws are expected to be fixed in Linux 2.6.12 (rc to show
up by tomorrow or so), although, as per Linus words, "that code is
horrid", and it may take some time to work out all the issues.
The impact is not dramatic, but there are two obvious ways such flaws can
be used to benefit remote attackers:
1) Bugs in removable media filesystems may be used to automatically
compromise any system whose owner decided to examine a newly acquired
CD-ROM, even if extreme caution is observed (that is, autorun is
disabled, and no files are executed).
2) For all types of filesystems, such problems can be additionally used
to subvert forensic analysis efforts. Disk images from compromised
machine may infect forensic examiner's system and alter results,
or simply render the machine unusable.
Attached is a trivial fuzz script that can be used to test fs drivers
against most obvious fault conditions. With little effort, it can be
further altered to test filesystems other than ISO9660, and OSes other
than Linux.
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
This might be of some interest to forensics folks, since some
methodologies advocate read-only mounting and examination of acquired disk
images... it might be not such a wise idea, in general.
---------- Forwarded message ----------
Date: Thu, 17 Mar 2005 22:36:45 +0100 (CET)
Subject: Linux ISO9660 handling flaws
There appears to be a fair number of kernel-level range checking flaws in
ISO9660 filesystem handler (and Rock Ridge / Juliet extensions) in Linux
up to and including 2.6.11. These bugs range from DoS conditions to
potentially exploitable memory corruption - all this whenever a specially
crafted filesystem is mounted or directories are examined.
Most apparent flaws are expected to be fixed in Linux 2.6.12 (rc to show
up by tomorrow or so), although, as per Linus words, "that code is
horrid", and it may take some time to work out all the issues.
The impact is not dramatic, but there are two obvious ways such flaws can
be used to benefit remote attackers:
1) Bugs in removable media filesystems may be used to automatically
compromise any system whose owner decided to examine a newly acquired
CD-ROM, even if extreme caution is observed (that is, autorun is
disabled, and no files are executed).
2) For all types of filesystems, such problems can be additionally used
to subvert forensic analysis efforts. Disk images from compromised
machine may infect forensic examiner's system and alter results,
or simply render the machine unusable.
Attached is a trivial fuzz script that can be used to test fs drivers
against most obvious fault conditions. With little effort, it can be
further altered to test filesystems other than ISO9660, and OSes other
than Linux.
Regards,
Michal Zalewski
Obligatory plug: http://lcamtuf.coredump.cx/silence/
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
[ reply ]