Remote binary planting on Windows soil

he fact that both userhelper and PAM follow '..' paths allows us to create a file that causes userhelper (by way of PAM) to dlopen any shared object we want as root. The exploit is simple, and utilizes the '-w' option of userhelper, which lets us specify a program to run with the privileges designated by PAM. This tries to only execute programs that have entries in /etc/security/console.apps, but since we get to specify the name, something like ../../../tmp/myprog gets us a file open path that looks like /etc/security/console.apps/../../../tmp/myprog. "strcat" is not a good way to keep a filename below a directory!

That advisory detailed a vulnerability in iTunes for Windows that hackers could exploit by persuading users to download and open a malformed media file, or by duping them into visiting a malicious Web site, where they would fall prey to a drive-by attack.

Apple patched the iTunes for Windows bug last March when it updated the music player to Version 9.1. According to Apple, the bug does not affect Mac machines.

Acros' advisory insinuated that the vulnerability was in more than just iTunes. "Additional details are available to interested corporate and government customers under NDA, as public disclosure would reveal too many details on the vulnerability and unduly accelerate malicious exploitation," the warning said.

It would have been odd for Acros to note the possibility of exploitation if the bug was iTunes-only and had been patched months earlier.

Moore confirmed that the flaw "applies to a wide range of Windows applications," and added that he stumbled across it while researching the Windows shortcut vulnerability, a critical bug that Microsoft acknowledged in July and patched on Aug. 2 using one of its rare "out of band" emergency updates.

Moore declined to name the applications that contain the bug or to go into great detail about the vulnerability. But he was willing to share some observations.

"The vector is slightly different between applications, but the end result is an attacker-supplied .dll being loaded after the user opens a 'safe' file type from a network share [either on the local network or the Internet]," Moore said in an e-mail reply to questions. "It is possible to force a user to open a file from the share, either through their Web browser or by abusing other applications, for example, Office documents with embedded content."

Some of what Moore described was reminiscent of the attacks using the Windows shortcut vulnerability. For instance, hackers were able to launch drive-by attacks exploiting the shortcut bug from malicious sites via WebDAV, and could embed their exploits into Office documents, which would presumably be delivered to victims as seemingly innocuous e-mail attachments.

Tacno, je mozes ti preko enviroment var-ova da promenis search path, ali kao sto rekoh to se radi PRE ucitavanja aplikacije.

It was discovered that ltdl, a system-independent dlopen wrapper for GNU libtool, can be tricked to load and run modules from an arbitrary directory, which might be used to execute arbitrary code with the privileges of the user running an application that uses libltdl. Updated packages are available from security.debian.org.

I opet u svakom slucaju steta koju moze da napravi sa korisnickim privilegijama je smesna :)

vlada_vlada, taj clanak je pausalan i nedorecen, moracemo da sacekamo da daju full disclosure da vidimo o cemu se radi, ali i po samom tekstu mi se cini da je explit vezan za programe a ne za OS per se (iTunes, webdav, office, itd), a radni direktorijum definitivno ne moze da bude nista sem UNCa, probaj, videces. Bice da tih 200 racuna da ce se osloboditi loseg PR za sopstveni idiotizam ako zajednicki optuze MS sto im je dao LoadLibrary() ;) U svakom slucaju nema ni govora o eskalaciji privilegija tako da ovo ionako nije neki exploit ako nisi local admin.

Ih kad bih ja mogao da svucem .so sa neta, da ga sibnem u direktorijum odakle pokrecem aplikaciju i da mi se omoguci ta funkcionalnost. Malo morgen. :) Nadji ga u /usr/lib nema, nadji ga u /lib nema, nadji ga u /usr/local - nema, u radnom direktorijumu vidi ima, hoce da radi :D

tako da ovo ionako nije neki exploit ako nisi local admin.

vlada_vlada: Kompromis korisnickog naloga je zapravo daleko slozeniji zadatak od naknadne eskalacije privilegija.

Wet dream security analista. U praksi jedan "Click here to download Facebook extension! Super! Extra! Get while free!" link resava problem ma koliko "Yes, I trust this program" dugmica mora da pritisne ;) Ispkreno mislim da se ovde pravi slon od muve.

Sa druge strane, ovde imamo vise od 200 windows aplikacija u kojima su programeri bili malo aljkavi.

Scenario koji meni deluje logican jeste da se propust moze iskoristiti ukoliko aplikacija ucitava dll koji se nalazi u nekom PATH-u (SafeDllSearch enabled), sto deluje izgledno i jasno govori da developeri nisu ni razmisljali o mogucnosti da im neko uvali drugi dll. To je prilicno neozbiljno, jer LoadLibrary() u svom opisu jasno govori o redosledu pretrage. Iskreno, cudi me da nisu pretpostavili mogucnost da im se na putu nadje dll sa istim imenom pre nogo dodje do lokacije u PATH varijabli.

Sto se tice problema koje je iskopao gosn' Dimkovic, jedan je fixovan pre vise od 10 godina (januar 2000), a drugi se odnosi na libtool koji se koristi u build procesu. Nekako su mi ti primeri neadekvatni za poredjenje sa propustom iz naslova teme.

i jasno govori da developeri nisu ni razmisljali o mogucnosti da im neko uvali drugi dll. To je prilicno neozbiljno, jer LoadLibrary() u svom opisu jasno govori o redosledu pretrage. Iskreno, cudi me da nisu pretpostavili mogucnost da im se na putu nadje dll sa istim imenom pre nogo dodje do lokacije u PATH varijabli.