日前,国外安全研究组织Nikita Tarakanov称在Symantec PGP Whole Disk Encryption(完整磁盘加密软件)中发现0day漏洞,该软件的内核驱动程序pgpwded.sys包含一个覆盖任意内存的漏洞,可执行任意代码,受影响的软件版本是Symantec PGP Desktop 10.2.0 Build 2599。) r0 c6 y, w, n) ^
0 d5 T" z) u0 w/ |- E( nSymantec通过博客文章证实该版本软件确实存在安全问题,但是利用起来比较繁琐,并且仅限于运行在Windows XP和Windows 2003的系统,成功利用该漏洞需要有计算机本地访问权限。/ R) B8 v) F+ k. ^
q( |" u r; P' N! H _& W* T
研究员Kelvin Kwan称“该漏洞触发场景非常困难,成功利用必须进入一些错误状态,但是成功利用的话可能允许攻击者执行任意代码,获取更高级别的权限”。该漏洞详细细节如下:) D& E% e" l4 R+ `1 n* [& [
( V0 k) U7 m; l) M+ H/ ?
, L: a* L( F0 Q8 F7 ~0 [; W" v3 [# q7 _: i$ c
function at 0x10024C20 is responsible for dispatching ioctl codes:" X" w6 V# Y5 ?# g
) e- |* j& R) V, l2 {' ?, P$ m.text:10024C20 ; int __thiscall ioctl_handler_deep(int this, int ioctl, PVOID inbuff, unsigned int inbuff_size, unsigned int outbuff_size, PDWORD bytes_to_return)
0 I0 E) Q4 V, ^* a) Z' h1 }/ P! N.text:10024C20 ioctl_handler_deep proc near ; CODE XREF: sub_10007520+6Ap% p" _8 [0 T% W5 ~4 ^
.text:10024C20
4 k, F$ {4 C7 k.text:10024C20 DestinationString= UNICODE_STRING ptr -3Ch
) R5 a" w- g" [: U.text:10024C20 var_31 = byte ptr -31h/ x' O9 e% T$ t: ^% B; C
.text:10024C20 var_30 = dword ptr -30h. o4 `' t4 [! b, P6 b" K9 e
.text:10024C20 some_var = dword ptr -2Ch
+ q! l* e8 v! n.text:10024C20 var_28 = dword ptr -28h4 d+ r3 [* P5 H
.text:10024C20 var_24 = byte ptr -24h% j# \* N+ b! x: C) @) I# c+ \& @
.text:10024C20 var_5 = byte ptr -5
% i J4 m# J( V- V, j8 V/ V.text:10024C20 var_4 = dword ptr -42 }& d; r3 _- J0 }
.text:10024C20 ioctl = dword ptr 8
" e1 D5 M# M5 `3 Y* j* k" R4 m% v.text:10024C20 inbuff = dword ptr 0Ch
5 X+ t' H3 G& y1 c L.text:10024C20 inbuff_size = dword ptr 10h
7 }: L: Y" P# Z' b/ `$ F.text:10024C20 outbuff_size = dword ptr 14h
! Q. n2 L/ d' k' N/ a9 a.text:10024C20 bytes_to_return = dword ptr 18h$ L$ _, B( V" f$ T w, L% h9 F" ?
.text:10024C20
/ T7 }, l. d8 c: x.text:10024C20 push ebp
1 K' y9 k1 @# ~2 G/ k.text:10024C21 mov ebp, esp
% m H D: I/ M& i+ @.text:10024C23 sub esp, 3Ch
- V) p+ w- F& p3 K.text:10024C26 mov eax, BugCheckParameter2: \; U/ w( e% ]9 D
.text:10024C2B xor eax, ebp
8 P1 H. E: D, l: n9 v.text:10024C2D mov [ebp+var_4], eax9 x# J, u0 \ ^; |, k
.text:10024C30 mov eax, [ebp+ioctl]. a- z' P# p8 G3 R% b/ O
.text:10024C33 push ebx9 h# f: F6 H3 X/ R8 h
.text:10024C34 mov ebx, [ebp+inbuff]
' ?* G C% p8 M- |.text:10024C37 push esi- K+ j/ n2 b. \* I
.text:10024C38 mov esi, [ebp+bytes_to_return]8 ~7 P0 p% z+ D. C- o- e
.text:10024C3B add eax, 7FFDDFD8h
( ~, W" D) p6 P.text:10024C40 push edi; O& @! }) \. c
.text:10024C41 mov edi, ecx
; V. r% _& x/ @$ R, }5 D: H6 o.text:10024C43 mov [ebp+some_var], esi
0 D. X2 A4 \! b.text:10024C46 mov [ebp+var_28], 07 u' v; S- G, i4 k
.text:10024C4D cmp eax, 0A4h ; switch 165 cases# @, r6 z4 j8 {+ V
.text:10024C52 ja loc_10025B18 ; jumptable 10024C5F default case/ @8 p7 W( B$ w3 B9 {1 o9 w
.text:10024C58 movzx eax, ds:byte_10025BF0[eax]
. I/ w/ C8 ]/ l0 m% [3 |5 }.text:10024C5F jmp ds ff_10025B50[eax*4] ; switch jump' s3 d5 X. D' y
* M2 p. h0 `" l$ |[..]( E- J' O' ^ e/ h
, f' `) S0 L$ ~5 E! {; x
0x80022058 case: no check for outbuff_size == 0! <--- FLAW!
- X- O4 {- s0 a$ Q9 Q3 U2 I& E, s: |# }- v/ d
.text:10024F5A lea ecx, [edi+958h]1 W/ C, p/ @3 `# h, m/ J
.text:10024F60 call sub_100237B0; v8 j3 Z( s9 @' m( b+ {
.text:10024F65 mov [ebp+some_var], eax
6 L* n4 H" H/ z& `; {" z. Q$ ~.text:10024F68 test eax, eax: }) ]9 d* |. ~( M& D4 W
.text:10024F6A jnz short loc_10024F7D$ a" }: t2 V. p# {9 q% G v0 z! D
.text:10024F6C mov dword ptr [ebx], 0FFFFCFFAh
2 C/ L2 D3 h1 p' `.text:10024F72 mov dword ptr [esi], 10h <--- bytes to copy to output buffer; M8 L7 T7 `- n+ T2 G( J
8 z: ? k6 d, m# g5 _* R
next in IofComplete request will be rep movsd at pointer, that is under attacker's control. t2 K% |3 ^- u: c5 S
$ }& C ]: V' b% J' h6 {/ `
Due the type of vulnerability (METHO_BUFFERED with output_size == 0) exploit works only on Winows XP/2k3, cause in later Windows OS I/O manager doesn't craft IRP if ioctl is METHOD_BUFFERED and output_size == 0. / U( \6 G) R% S2 E
& ^/ I$ m0 Q& |2 |: h- C1 P; Z% YSymantec表示在2月份的补丁包中修复该漏洞。7 T6 D { o% i& n, D: N
; Q4 e; F; v3 Z1 j% z3 v相关阅读:
; f( O7 t5 m3 O& r3 ~" e/ F2 K5 W
! J: H% e$ z$ l; I, \. b2 u. k7 t赛门铁克的 PGP Whole Disk Encryption 为企业提供了全面的高性能完整磁盘加密功能,可对台式机、笔记本电脑和可移动介质上的所有数据(用户文件、交换文件、系统文件、隐藏文件等)进行完整磁盘加密。该完整磁盘加密软件可让数据免遭未经授权的访问,从而为知识产权、客户和合作伙伴数据提供强大的安全防护。受保护的系统可由 PGP Universal Server 集中管理,这就简化了部署、策略创建、分发和报告过程。
% F0 Q' A/ f+ a' r& m+ c
0 P, {% P0 J8 ^+ ~3 `8 y' t |