标题: Symantec完整磁盘加密软件爆0day漏洞 [打印本页] 作者: admin 时间: 2013-1-11 21:11 标题: Symantec完整磁盘加密软件爆0day漏洞 日前，国外安全研究组织Nikita Tarakanov称在Symantec PGP Whole Disk Encryption（完整磁盘加密软件）中发现0day漏洞，该软件的内核驱动程序pgpwded.sys包含一个覆盖任意内存的漏洞，可执行任意代码，受影响的软件版本是Symantec PGP Desktop 10.2.0 Build 2599。 " k7 M' o: H) V% W' r 2 X5 W: c. J! XSymantec通过博客文章证实该版本软件确实存在安全问题，但是利用起来比较繁琐，并且仅限于运行在Windows XP和Windows 2003的系统，成功利用该漏洞需要有计算机本地访问权限。 1 x: z U% H1 ]( S K4 U$ ^0 ~! D- s% n$ m. ~* N
研究员Kelvin Kwan称“该漏洞触发场景非常困难，成功利用必须进入一些错误状态，但是成功利用的话可能允许攻击者执行任意代码，获取更高级别的权限”。该漏洞详细细节如下：' {7 w, f0 l3 J$ _6 l; j9 E i
7 C3 t/ Q* {- s6 P 3 k8 q" S& w5 [6 f 4 s! @. v$ S; ], e1 {function at 0x10024C20 is responsible for dispatching ioctl codes:2 u9 n1 ^$ V2 c6 a& v
6 _8 q" D, c5 F6 p. L4 i2 C
.text:10024C20 ; int __thiscall ioctl_handler_deep(int this, int ioctl, PVOID inbuff, unsigned int inbuff_size, unsigned int outbuff_size, PDWORD bytes_to_return) " H8 j5 C- Z5 w; K0 z1 B% c t.text:10024C20 ioctl_handler_deep proc near ; CODE XREF: sub_10007520+6Ap0 U1 H0 h. t3 d# `* z: w% x3 Q. \
.text:10024C205 x! @/ [+ Z! B7 [: G/ a
.text:10024C20 DestinationString= UNICODE_STRING ptr -3Ch- w z, s8 q, s
.text:10024C20 var_31 = byte ptr -31h8 F. g0 e- e# c$ u
.text:10024C20 var_30 = dword ptr -30h, v3 z& }7 Y/ k8 E8 i
.text:10024C20 some_var = dword ptr -2Ch , W6 [+ h8 H- s X.text:10024C20 var_28 = dword ptr -28h7 i* A. B6 | p- G2 x; X: \. M
.text:10024C20 var_24 = byte ptr -24h! L4 |! ?4 P. c. ^, R I n! z4 B! a
.text:10024C20 var_5 = byte ptr -5 + u a/ ?8 X& _0 j$ p3 J% ~& i.text:10024C20 var_4 = dword ptr -4 9 N( f4 D' @/ U- }.text:10024C20 ioctl = dword ptr 8( Z8 I, M0 M: a3 `2 @. w8 |
.text:10024C20 inbuff = dword ptr 0Ch# Z! H/ `) z: D* o" b
.text:10024C20 inbuff_size = dword ptr 10h % d1 a; T' `- f.text:10024C20 outbuff_size = dword ptr 14h / `/ W0 }; p& l$ P* B! N- J5 Q( t.text:10024C20 bytes_to_return = dword ptr 18h 1 m1 h, C- s, g# A4 r/ q.text:10024C20 8 z' g- T% L) l.text:10024C20 push ebp; q5 C, K; }8 d S% \$ B
.text:10024C21 mov ebp, esp : M" ]. }, Z. F) x8 e.text:10024C23 sub esp, 3Ch4 \; Y( B, ?1 ?# _
.text:10024C26 mov eax, BugCheckParameter2/ I' C% y( _2 ~) p# u' z6 f
.text:10024C2B xor eax, ebp. ^0 ? i/ y% U. G) q7 p
.text:10024C2D mov [ebp+var_4], eax 8 n. d6 B0 K# |' f' b0 z) y3 G.text:10024C30 mov eax, [ebp+ioctl]2 f: G; g( q: T n; c
.text:10024C33 push ebx 5 G$ C/ e) i' o: N# d, A8 `7 h) b- S.text:10024C34 mov ebx, [ebp+inbuff] q" x8 h' W2 ]% {2 V3 z- j! P+ o
.text:10024C37 push esi n2 }5 l/ j6 {3 M+ v.text:10024C38 mov esi, [ebp+bytes_to_return] 6 x* ?; N8 D( F: V- B4 k# r.text:10024C3B add eax, 7FFDDFD8h7 r& Q! d, P- R( i8 L' C- w
.text:10024C40 push edi& i% P- O7 Z; v b0 h; r8 h
.text:10024C41 mov edi, ecx* v; x! |$ @- s( h
.text:10024C43 mov [ebp+some_var], esi p2 I" k& J4 G& q- H! u.text:10024C46 mov [ebp+var_28], 0- @$ \* C( {2 [- _/ L: b6 y- @( Y& p) t$ B
.text:10024C4D cmp eax, 0A4h ; switch 165 cases 7 V1 |+ U8 s1 w% m.text:10024C52 ja loc_10025B18 ; jumptable 10024C5F default case / d: X$ P, `7 o) v' O! A! x% k.text:10024C58 movzx eax, ds:byte_10025BF0[eax]0 U f# C* S+ }7 c) h( t8 u
.text:10024C5F jmp dsff_10025B50[eax*4] ; switch jump : q) M( o! k+ L& C: E% G" G. w6 S9 o, ?1 s9 Z: ]
[..] / X& A# I9 }6 x2 i3 r7 n# C/ |8 Q* z& @* p& ^) f
0x80022058 case: no check for outbuff_size == 0! <--- FLAW! S& X: @! N/ r5 A9 E( t! E1 Z+ I6 I
# X& Y0 [, j) g- p7 m- g* v
.text:10024F5A lea ecx, [edi+958h] - u# \! y/ j/ s' i$ Q$ F.text:10024F60 call sub_100237B03 a0 m* D0 L( G' r( g; k- w5 J3 q( a% ]
.text:10024F65 mov [ebp+some_var], eax 5 w0 t9 _& w* ]5 D5 o1 `* y: J0 B3 ]7 e.text:10024F68 test eax, eax * w7 P2 t- k, `0 N.text:10024F6A jnz short loc_10024F7D & R$ p* }# `) ]8 b H( S2 M* z.text:10024F6C mov dword ptr [ebx], 0FFFFCFFAh % i5 f/ I8 g, \. p.text:10024F72 mov dword ptr [esi], 10h <--- bytes to copy to output buffer$ V. Z$ W, t) H% y7 E/ e5 Z6 ]6 X1 Q1 z
/ W: T) {9 f- Q8 g, H( R8 anext in IofComplete request will be rep movsd at pointer, that is under attacker's control2 o5 V S9 Q! B0 S( X- C6 f
* I# K* p: E0 Y" F
Due the type of vulnerability (METHO_BUFFERED with output_size == 0) exploit works only on Winows XP/2k3, cause in later Windows OS I/O manager doesn't craft IRP if ioctl is METHOD_BUFFERED and output_size == 0. " R' {$ }/ g: l5 p6 m
* u4 }4 `& C+ U% H# a! d; cSymantec表示在2月份的补丁包中修复该漏洞。, r8 Q% T! g0 A: _: d. j4 H J
ff_10025B50[eax*4] ; switch jump