Microsoft Host Integration Server <= 8.5.4224.0 DoS Vulnerabilities

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Microsoft Host Integration Server <= 8.5.4224.0 DoS Vulnerabilities

来源：aluigi@autistici.org 作者：Luigi 发布时间：2011-04-13

Source: http://aluigi.org/adv/snabase_1-adv.txt

#######################################################################

Luigi Auriemma

Application: Microsoft Host Integration Server
              http://www.microsoft.com/biztalk/en/us/host-integration.aspx?pf=true
Versions:     <= 8.5.4224.0
Platforms:    Windows
Bugs:         various Denial of Service vulnerabilities
Exploitation: remote, versus server
Date:         11 Apr 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

From vendor's website:
"Microsoft Host Integration Server technologies and tools enable
enterprise organizations to integrate existing IBM host systems,
programs, messages and data with new Microsoft server applications."

#######################################################################

=======
2) Bugs
=======

The following are only Denial of Service vulnerabilities and there are
for sure some others but sincerely who cares?
Just for quick reference...

A]
--
Endless loop affecting all the services that use the TCP protocol so
snabase.exe on port 1478, all the snalink.exe on their dynamic ports,
snaservr.exe, mngagent.exe and so on.
The cause is "word[packet] - 2" that forces the continuous parsing of
the same data.

Instead the following bugs affect only the UDP protocol used in
snabase.exe listening on the port 1478.
When this service terminates also the others depending by it like
snalink and msngagent will terminate.

the crash is caused by the tentative of accessing the unallocated
memory located after the packet of max 0x1ee bytes.

C]
--
an UDP packet longer than 0x1ee bytes blocks the receiving of any
other UDP packet.

exception if the string is too big.

F]
--
forced termination:
"Error: Primary Host Integration Server computer already running in ???"

G]
--
6748A73F   . 8B45 08       MOV EAX,DWORD PTR SS:[EBP+8]
6748A742   . 83C0 03       ADD EAX,3
6748A745   . 50            PUSH EAX
6748A746   . 6A 10         PUSH 10
6748A748   . 68 F0F04F67   PUSH 674FF0F0
6748A74D   . FF15 38134467 CALL DWORD PTR DS:[<&MSVCR80.strcpy_s>]

if the string is longer than 0x10 bytes then the server will raise an
exception and terminates.

H]
--
606CC91A    68 1C010000     PUSH 11C
606CC91F    6A 40           PUSH 40                                   ; allocate 0x40 bytes
606CC921    FF15 30106C60   CALL DWORD PTR DS:[<&KERNEL32.LocalAlloc> ; kernel32.LocalAlloc
606CC927    8945 E4         MOV DWORD PTR SS:[EBP-1C],EAX
606CC92A    837D E4 00      CMP DWORD PTR SS:[EBP-1C],0
606CC92E    0F84 D8000000   JE 606CCA0C
606CC934    FF75 08         PUSH DWORD PTR SS:[EBP+8]                 ; our string
606CC937    6A 10           PUSH 10                                   ; max size
606CC939    8B45 E4         MOV EAX,DWORD PTR SS:[EBP-1C]
606CC93C    83C0 0C         ADD EAX,0C
606CC93F    50              PUSH EAX                                  ; destination
606CC940    FF15 5C116C60   CALL DWORD PTR DS:[<&MSVCR80.strcpy_s>]   ; MSVCR80.strcpy_s

if the string is longer than 0x10 bytes then the server will raise an
exception and terminates.

I]
--
The opcode 0x02 allows to use an arbitrary MessageId argument in
FormatMessage causing the crash through the values 0x11 and 0x26:
_snwprintf(buffer, buffer_size, "%hs", (char *)9);

J]
--
memcmp crash caused by the accessing of unallocated memory after the
packet.

K (maybe)]
----------
snabase allows to start an existent service and even passing
parameters to it through a packet with opcode 0x04.
normally this is not an issue because the server runs with an
unprivileged user (if you assign Administrator as "Service
credential" the configurator of the installer will ask for
confirmation) and as far as I know the HIS services don't use
arguments.
anyway in some particular conditions or if have been used the
Administrator credentials this feature may be "interesting".

#######################################################################

===========
3) The Code
===========

http://aluigi.org/poc/snabase_1.zip
http://www.exploit-db.com/sploits/17159.zip

A]
nc SERVER PORT < snabase_1a.dat

others]
nc SERVER 1478 -u < snabase_1?.dat

Note that the pre-built packet files use the fixed destination name
VBOX so change the string in the packets accordingly with the real
target machine or domain name.
Note that snabase_1k.dat must be customized to work: service name,
optional arguments and remember to change at least one char of the
string at offset 3 each time or the packet will be ignored if it
contains the same string of the previous one.

#######################################################################

======
4) Fix
======

No fix.

#######################################################################

[