-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ~ Core Security Technologies - CoreLabs Advisory ~ http://www.coresecurity.com/corelabs ~ CORE FORCE Kernel Buffer Overflow *Advisory Information* Title: CORE FORCE Kernel Buffer Overflow Advisory ID: CORE-2007-1119 Advisory URL: http://www.coresecurity.com/?action=item&id=2025 Date published: 2008-01-17 Date of last update: 2008-01-17 Release mode: Coordinated release *Vulnerability Information* Class: Input validation error (Buffer Overflow) Remotely Exploitable: No Locally Exploitable: Yes Bugtraq ID: None currently assigned CVE Name: None currently assigned *Vulnerability Description* CORE FORCE is the first community oriented security solution for personal computers that provides a comprehensive endpoint security solution for Windows 2000 and Windows XP systems. CORE FORCE provides inbound and outbound stateful packet filtering for TCP/IP protocols using a Windows port of OpenBSD's PF firewall, granular file system and registry access control and programs' integrity validation. These capabilities can be configured and enforced system-wide or on a per-application basis for specific programs such as email readers, Web browsers, media players, messaging software, etc. The security framework provided by CORE FORCE is leveraged by a community of security experts that share their security configurations for a growing list of programs. These security profiles can be downloaded by any user of CORE FORCE from the community Web site and they're also completely open so that they can be peer-reviewed to minimize security hazards. Locally exploitable kernel buffer overflow vulnerabilities and unproperly validated input arguments have been found in CORE FORCE Firewall and Registry modules. The vulnerabilities allow unprivileged logged on users to crash the system (denial of service), and they also may lead to a privilege escalation or even a local root exploit. *Vulnerable packages* - - CORE FORCE 0.95.167 and below. *Non-vulnerable packages* - - CORE FORCE 0.95.172. *Vendor Information, Solutions and Workarounds* This vulnerability was fixed in CORE FORCE version 0.95.172 which is available at: http://force.coresecurity.com/ *Credits* This vulnerability was discovered by Sebastian Gottschalk. *Technical Description / Proof of Concept Code* The firewall functionality of CORE FORCE is as a port of OpenBSD's PF firewall implemented as an NDIS complaint kernel driver that mediates communications between the Network card and the TCP/IP stack of the operating system. Thus stateful, bi-directional firewalling rules can be enforced independently of the Windows OS firewall capabilities and at a deeper layer, closer to the wire. The kernel driver is accessible to a user mode application via IOCTL functions. There are 4 IOCTL functions on the firewall driver module that use input received from userspace and do not validate the length of the input buffers properly. By calling any of these IOCTLs from with properly crafted arguments, an unprivileged user could trigger vulnerabilities in the driver and cause a denial of service or potentially to execute arbitrary code with elevated privileges. Similarly other 7 SSDT hook handler functions on the driver that intercepts the Registry access on Windows are vulnerable to input validation errors. All the vulnerabilities can be reproduced by running a combination of DC2 and BSODHook tools. Step by step instructions: - - Get DC2.exe (Driver Path Verifier) from the latest Windows Driver Kit. - - Login as unprivileged user. - - Run "dc2 /hct /a". - - Get BSODHook.exe from Matousec [3]. - - Click on "Load Driver" then click on "Find SSDT hooks" then "Add to probe list" and then "GO". *Report Timeline* 2007-11-04: Initial notification by independent researcher Sebastian Gottschalk. 2007-11-05: Email acknowledging reception of the bug reports and indicating that looking into the report would probably take Core more than a week. Core requested details to reproduce a second type of bug related to hooking of the SSDT. 2007-11-05: Email from Sebastian Gottschalk indicating that the BSODhook from Matousec [3] could be used to reproduce the SSDT hooking problems. 2007-11-19: A fix is produced by the Core Force team. Core asks the researcher whether he wants to be credited for the discovery in the advisory. 2007-11-22: Sebastian Gottschalk accepts to be credited. 2007-11-28: Email sent to Sebastian Gottschalk indicating the Core found a bug in the fix and will have to delay publication of a fixed version of Core Force. 2007-11-29: New fix committed by the Core Force team. 2007-12-17: Other functions were also found vulnerable in the Registry module. 2008-01-07: New fix committed by the Core Force team. 2008-01-17: CORE-2007-1119 advisory is published. *References* [1] CORE FORCE: http://force.coresecurity.com/ [2] Driver testing: http://blogs.msdn.com/ravig/default.aspx [3] http://www.matousec.com/projects/windows-personal-firewall-analysis/plag ue-in-security-software-drivers.php *About Corelabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at http://www.coresecurity.com/corelabs/ *About Core Security Technologies* Core Security Technologies develops strategic solutions that help security-conscious organizations worldwide develop and maintain a proactive process for securing their networks. The company's flagship product, CORE IMPACT, is the most comprehensive product for performing enterprise security assurance testing. IMPACT evaluates network, endpoint and end-user vulnerabilities and identifies what resources are exposed. It enables organizations to determine if current security investments are detecting and preventing attacks. Core augments its leading technology solution with world-class security consulting services, including penetration testing and software security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core Security Technologies can be reached at 617-399-6980 or on the Web at http://www.coresecurity.com. *DISCLAIMER* The contents of this advisory are copyright (c) 2008 CORE Security Technologies and (c) 2008 CoreLabs, and may be distributed freely provided that no fee is charged for this distribution and proper credit is given. *PGP/GPG KEYS* This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.a sc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFHj8awyNibggitWa0RAlgQAJ4kCQN5DtnqbcPRaE1KzOtn1FQK/gCeIUD2 WzEfNAgVcXka0pzVjOkH7D0= =7yMt -----END PGP SIGNATURE-----