From: Li Gen (superligengmail.com)
Date: Sat Sep 13 2008 - 04:05:26 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Baidu Hi IM software parsing plaintext stack overflow

-- CVE ID:
Not assigned

-- Affected Vendors:
Baidu

-- Affected Products:
Baidu Hi IM software

-- Vulnerability Details:

Our automatic bug exploiting tools have found a buffer overflow bug in
Baidu Hi IM software which is a popular IM software in China.
This bug is due to Baidu Hi do not strictly check the deciphered
plaintext format in CSTransfer.dll.
Because of encryption mechanism of Baidu Hi, it is hard to generate
the proper malicious packet, but not say it's impossible. A proper
malicious packet can cause client system full controlled.

-- Vendor Response:
I contacted with Baidu a month ago, no any response from Baidu.

-- Credit:
This vulnerability was discovered by:
  Gen LI & Jun MA & Ying Zhang

More Detail :
(CSTransfer.dll)

                                          esi
      +---------------------+ |
      | | \|/
      | Malicious input | _______________________________
      | ...........> | | | | | | | | |
      +---------------------+ |R | |4 |0 | |\r |\n | .... |
                                          |__|__|__|__|__|___|___|_______|
                                          /|\
                                           |
                                          ebp
      +---------------------+
      | |
      | Correct content |
______________________________________________________
      | ...........> | | | | | | | | |
| | | | | | |
      +---------------------+ | c| m | | 1| . |0 | |R |
|4 |0 | |\r |\n | .... |
        loc_10007880:
|__|___|_|__|___|__|___|__|__|__|__|__|___|___|_______|
        mov al, [esi-1] /|\ /|\
        dec esi | |
        cmp al, 20h ebp esi
        jnz short loc_10007890
                 |
  +-------+ |---------------------.
  | | | |
  | \|/ \|/ |
  | loc_10007888: |
  | mov al, [esi-1] |
  | dec esi |
  | cmp al, 20h |
  | jz short loc_10007888 |
  | | | |
  |-----------+ | +----------------|
                 | |
                \|/ \|/
        loc_10007890:
        push 20h
        esi edi
        push ebp +---------------------+
         | |
        inc esi | |
        \|/ \|/
        call ds:strchr | Malicious input |
____________ _______________________________
        mov edi, eax ---------> | ...>|
        | | | | | | | | |
                                        +---------------------+
|heap struct |R | |4 |0 | |\r |\n | .... |
           ...........
|____________|__|__|__|__|__|___|___|_______|

        /|\
       loc_100078EA:
         |
       sub esi, edi ;esi will be a negative number
        ebp
       cmp esi, 1Eh
       jg loc_100079FD

       push esi ; size_t ;esi will be a negative number
       lea edx, [esp+44h+var_24]
       push edi ; char *
       push edx ; char *
       call ds:strncpy ; cause buffer overflow

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]