OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Matt Conover (shokdataforce.net)
Date: Tue Apr 16 2002 - 01:52:02 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    w00w00 (http://www.w00w00.org)
    Angry Packet Security (http://sec.angrypacket.com)

    Vulnerability in Multiple Microsoft Products for Mac OS
    HTML format: http://www.w00w00.org/advisories/ms_macos.html
    Text format: http://www.w00w00.org/files/advisories/ms_macos.txt

    SOFTWARE VERSIONS AFFECTED

    Microsft Internet Explorer
    Versions affected: 5.1
    Platforms affected: Mac OS 8, 9, and X

    Microsft Outlook Express
    Versions affected: 5.0.2
    Platforms affected: all Mac OS

    Microsft Entourage
    Versions affected: 2001 and X
    Platforms affected: all Mac OS

    Microsft PowerPoint
    Versions affected: 98, 2001, and X
    Platforms affected: all Mac OS

    Microsft Excel
    Versions affected: 2001 and X
    Platforms affected: all Mac OS

    Microsft Word
    Versions affected: 2001
    Platforms affected: all Mac OS

    PRELUDE

    A bug in Internet Explorer for Mac OS X was originally reported to
    Microsoft by Josha Bronson of Angry Packet Security on January 4,
    2002.

    Due to some internal mishandling at Microsoft, this was brushed off
    until w00w00 informed Microsoft of its intention to release the
    information on February 17. We originally gave them a deadline of
    two weeks until we discovered that this affected Entourage (the
    Outlook-equivalent for Mac OS). When Microsoft determined this
    affected most of their Office suite on Mac OS, we felt it was
    appropriate to give them time to fix it.

    DESCRIPTION

    There is a vulnerability in multiple Microsoft products on Mac OS.
    The problem lies in the handling of a lengthy subdirectory in the
    file:// directive, such as file:///AAAAAA[...] or
    file://A/A/A/A/[...]. The number of subdirectories is trivial as
    long as there is at least one.

    IMPLICATIONS

    This is another vulnerability with potentially far reaching
    consequences. In the case of Entourage, it has the potential for a
    worm, with the magnitude depending on how many people actually use
    Entourage (Microsoft's Outlook equivalent for Mac OS). In all cases,
    writing shellcode to exploit this problem is simply--much more
    simple than shellcode for the AOL Instant Messenger problem we
    reported in January. Given that Mac OS X has a Unix interface,
    existing PowerPC shellcode that runs /bin/sh will work. No complex
    shellcode is needed to bind to a port or download an application off
    the web. The /bin/sh shellcode would need to be changed from an
    interactive shell to one that will execute a chain of commands.
    There are enough commands on Mac OS by default to allow an attacker
    to download and execute an application off of a web page. The
    downloaded application could do any number of things, such as read
    off the user's contact list and send the same email to exploit to
    all of the user's contacts.

    EXPLOIT

    The following HTML file will demonstrate the problem. We chose to
    use IMG simply because that is instantly loaded, but an
    <A HREF=...> could have been used also. It can also be viewed (in
    live form) at http://www.w00w00.org/files/advisories/ie_sample.html.
    It overwrites the saved link register which is used for a
    subroutine's return address on PowerPC. This will allow remote
    execution of arbitrary code. The saved link register is overwritten
    by the 0x41424344. This vulnerability will allow up to 1313
    characters before the saved link register. Pure binary data
    (including NUL bytes) can be used by escaping it (i.e., A as %41).
    However, using "%41" will count as three characters, rather than
    just one. Note: by character I mean unibyte characters.

    <html>
    <body>
    <img src=file:///[1313 characters]%41%42%43%44>
    </body>
    </html>

    PATCHES

    For Internet Explorer, a patch is available from
    http://www.apple.com/macosx/upgrade/softwareupdates.html. For
    the other products, the patches can be downloaded from
    http://www.microsoft.com/mac/download.

    CREDIT

    w00w00 would like to thank Angry Packet for involving us in their
    efforts to get Microsoft to resolve this problem after their
    attempts failed.