日前,国外安全研究组织Nikita Tarakanov称在Symantec PGP Whole Disk Encryption(完整磁盘加密软件)中发现0day漏洞,该软件的内核驱动程序pgpwded.sys包含一个覆盖任意内存的漏洞,可执行任意代码,受影响的软件版本是Symantec PGP Desktop 10.2.0 Build 2599。
- |( `# I' C2 u, e1 u( P( D, m( ~: e$ c$ V- \3 Q
Symantec通过博客文章证实该版本软件确实存在安全问题,但是利用起来比较繁琐,并且仅限于运行在Windows XP和Windows 2003的系统,成功利用该漏洞需要有计算机本地访问权限。
9 R# I8 T( { Z% O
" Q$ j2 c3 F+ u' ~; c8 z研究员Kelvin Kwan称“该漏洞触发场景非常困难,成功利用必须进入一些错误状态,但是成功利用的话可能允许攻击者执行任意代码,获取更高级别的权限”。该漏洞详细细节如下:
0 }. u6 B1 K# O1 l
" X# Y5 G, v4 w% Z3 K# g! W 0 Z& w- N( e+ B' `2 f0 v4 `
* a: Z& K* z, G: E
function at 0x10024C20 is responsible for dispatching ioctl codes:
# M( Z! s/ Q; a' J @2 {# o8 l: l9 `0 |' l. x4 i
.text:10024C20 ; int __thiscall ioctl_handler_deep(int this, int ioctl, PVOID inbuff, unsigned int inbuff_size, unsigned int outbuff_size, PDWORD bytes_to_return)
. n+ l: a/ y1 _: W+ n0 t& _.text:10024C20 ioctl_handler_deep proc near ; CODE XREF: sub_10007520+6Ap
6 W* A" T# p) t- u, Y1 q.text:10024C20
# F+ I' q7 x1 r9 _- [% f' o' u+ H.text:10024C20 DestinationString= UNICODE_STRING ptr -3Ch+ z3 \8 c6 K' R1 V* ?
.text:10024C20 var_31 = byte ptr -31h
0 `+ F$ C5 }# l; b/ a+ P* G+ u.text:10024C20 var_30 = dword ptr -30h
) f" L/ w$ F7 Q$ E9 O.text:10024C20 some_var = dword ptr -2Ch
5 Q9 O% X4 F5 C' z.text:10024C20 var_28 = dword ptr -28h6 C, v; b9 {1 J; p' f ^
.text:10024C20 var_24 = byte ptr -24h/ H/ a( g4 I6 L5 r
.text:10024C20 var_5 = byte ptr -5
) J2 C& x- R2 `' ^7 J8 j.text:10024C20 var_4 = dword ptr -4 t0 |% t8 P: q1 Z
.text:10024C20 ioctl = dword ptr 8# B- Z1 m- Y$ Z5 S* D/ J' [) b
.text:10024C20 inbuff = dword ptr 0Ch4 |5 |# a3 A! \' l. }/ X# V
.text:10024C20 inbuff_size = dword ptr 10h G+ S$ y5 O$ i/ u/ x1 \5 y5 a
.text:10024C20 outbuff_size = dword ptr 14h
; B# j! A! k8 f2 R% ?.text:10024C20 bytes_to_return = dword ptr 18h8 o* [; |2 B% {
.text:10024C20
* U* \% H5 c3 Q$ S- B+ X2 v.text:10024C20 push ebp1 s1 h: Y5 u' ]" ]1 T4 `) z
.text:10024C21 mov ebp, esp# z6 |7 R8 O) |: t. V) N
.text:10024C23 sub esp, 3Ch
; m0 r' F0 {: ~6 [3 C.text:10024C26 mov eax, BugCheckParameter2# P+ | u: S% g! O' E
.text:10024C2B xor eax, ebp
9 f8 ^" D3 e+ K2 E.text:10024C2D mov [ebp+var_4], eax: Z% H& R8 Z! }2 e$ O+ y
.text:10024C30 mov eax, [ebp+ioctl]; u( t# _# D6 \- v% T; n0 h k
.text:10024C33 push ebx0 c1 o. a! ?$ C- X
.text:10024C34 mov ebx, [ebp+inbuff]6 q+ \. Y9 b' u6 d
.text:10024C37 push esi6 Q- W- l( E2 v- H
.text:10024C38 mov esi, [ebp+bytes_to_return]3 Q0 u, N( N/ i& ^
.text:10024C3B add eax, 7FFDDFD8h
* y3 r6 s2 q2 H4 [' w.text:10024C40 push edi: ^1 O) I$ B; N @# V' C+ N
.text:10024C41 mov edi, ecx
% n* j1 x d% {3 i& w1 m.text:10024C43 mov [ebp+some_var], esi; I6 p% u3 c# ^7 j A+ c6 |/ F
.text:10024C46 mov [ebp+var_28], 0
`, ~7 ~0 S; X0 T. S0 ? a.text:10024C4D cmp eax, 0A4h ; switch 165 cases1 |; ?5 c, S% [8 c, L
.text:10024C52 ja loc_10025B18 ; jumptable 10024C5F default case
$ ^; V5 A0 {8 K s; K7 b$ I.text:10024C58 movzx eax, ds:byte_10025BF0[eax]* E9 A, R4 H# N; J: m
.text:10024C5F jmp dsff_10025B50[eax*4] ; switch jump' S; R& `) N% ?0 V
9 t o7 j: v; a& A. Q) R
[..]
H# Z& S8 X5 R
) {3 }+ Q# n& t' ]- a) d) g0x80022058 case: no check for outbuff_size == 0! <--- FLAW!
; }$ Z& A8 V1 h7 e7 a4 N8 k8 X" p- t0 r! ? l4 D
.text:10024F5A lea ecx, [edi+958h]
0 m( O2 z9 |* A5 n ~- ].text:10024F60 call sub_100237B0
! O% p3 T- V% i3 D.text:10024F65 mov [ebp+some_var], eax
. O6 U% t2 h S.text:10024F68 test eax, eax: T, G% p0 u% R
.text:10024F6A jnz short loc_10024F7D1 M! G/ _! v) E! j. \0 i
.text:10024F6C mov dword ptr [ebx], 0FFFFCFFAh, t Z+ \# S0 X0 G$ r: P
.text:10024F72 mov dword ptr [esi], 10h <--- bytes to copy to output buffer* l1 v- e( G2 H$ @2 |* o- u
0 r- M$ ?2 @& ]% U' u% j
next in IofComplete request will be rep movsd at pointer, that is under attacker's control
* @) z( {7 _2 O3 k% @9 q2 ]: w; n9 g: b5 T5 s9 w/ o2 a
Due the type of vulnerability (METHO_BUFFERED with output_size == 0) exploit works only on Winows XP/2k3, cause in later Windows OS I/O manager doesn't craft IRP if ioctl is METHOD_BUFFERED and output_size == 0.
( ]+ Y9 r3 {# C2 w2 u- z5 q
9 t+ s3 S/ L" d& I) k1 S7 m4 y! NSymantec表示在2月份的补丁包中修复该漏洞。$ A- r( E, U' E
# L0 c" o$ B& m$ |" x8 q) r
相关阅读:
7 y( r& l2 D* N
. j$ Z+ J3 q; q" W+ n& `1 V赛门铁克的 PGP Whole Disk Encryption 为企业提供了全面的高性能完整磁盘加密功能,可对台式机、笔记本电脑和可移动介质上的所有数据(用户文件、交换文件、系统文件、隐藏文件等)进行完整磁盘加密。该完整磁盘加密软件可让数据免遭未经授权的访问,从而为知识产权、客户和合作伙伴数据提供强大的安全防护。受保护的系统可由 PGP Universal Server 集中管理,这就简化了部署、策略创建、分发和报告过程。8 Q+ s4 q/ r& r2 [% L6 k0 W
5 ?; z: c/ Y* C) @: y4 d
|