The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
None
PR
The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
None
C
There is no impact on the confidentiality of the system; the attacker does not gain the ability to read any data.
Integrity
None
I
There is no impact on the integrity of the system; the attacker does not gain the ability to modify any files or information on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Happy PPC Hacking Project
www.hardened-php.net
-= Security Advisory =-
Advisory: KisMAC Cisco Vendor Tag Encapsulated SSID Overflow
Release Date: 2006/03/23
Last Modified: 2006/03/23
Author: Stefan Esser [sesser (at) hardened-php (dot) net [email concealed]]
Application: KisMAC < dev version 113
KisMAC < 73p
Severity: Special crafted 80211 management frames may cause
a stackoverflow that eventually leads to remote
code execution
Risk: Critical
Vendor Status: Vendor has a released an updated version
References: http://www.hardened-php.net/advisory_032006.115.html
Overview:
Quote from www.kismac.de:
"KisMAC is a free stumbler application for MacOS X, that puts
your card into the monitor mode. Unlike most other applications
for OS X it has the ability to run completely invisible and
send no probe requests."
While playing around with wifi, raw packets, MacOS X, ppc and
KisMAC a quick audit revealed a remotely triggerable buffer
overflow in KisMAC's parser for tagged data in 80211 management
frames, that can lead to execution of arbitrary code.
To exploit this vulnerability an attacker must either trick the
victim in opening a pcap file containing the special crafted
management frames OR the attacker must send such raw frames
while the victim is performing a passive network scan.
Details:
When KisMAC receives a 80211 management frame (or finds one in
a imported pcap file) it parses the attached tagged data with
the function WavePacket:parseTaggedData. With the help of this
method the SSID, the channel and the rates get extracted from
the management packet.
The function in question also supports a special Cisco vendor tag,
which is scanned by KisMAC for additional SSIDs. Unfortunately it
then copies the SSIDs found into a 33 bytes big stackbuffer
without any kind of size check.
slen = (*(ssidl + 5)); // <-- reading SSID length (UINT8)
ssidl += 6;
if ((len -= slen) < 0) break;
@try {
memcpy(ssid, ssidl, slen); // <-- copying without check into 33
// bytes big stackbuffer
ssid[slen]=0;
[_SSIDs addObject:[NSString stringWithUTF8String:ssid]];
}
@catch (NSException *exception) {
[_SSIDs addObject:[NSString stringWithCString:(char*)(ssidl) length:slen]];
}
Due to the try/catch block around the memcpy() the stacklayout
allows to overwrite the jump_buf for setjmp/longjump which are
used for the exception handling. This actually means it is not
only possible to control the execution flow by manipulating the
program counter (pc) but also to have control over the content
of all registers once the execution flow has been manipulated.
It should be obvious that this eventually leads to the execution
of arbitrary code.
Proof of Concept:
The Happy PPC Hacking Project is not going to release exploits
for this vulnerability to the public.
Disclosure Timeline:
22. March 2006 - Contacted KisMAC developers by email
22. March 2006 - Vendor releases KisMAC update
23. March 2006 - Public Disclosure
Recommendation:
It is strongly recommended to upgrade to the newest version of
KisMAC which you can download at:
http://trac.kismac.de
GPG-Key:
http://www.hardened-php.net/hardened-php-signature-key.asc
pub 1024D/0A864AA1 2004-04-17 Hardened-PHP Signature Key
Key fingerprint = 066F A6D0 E57E 9936 9082 7E52 4439 14CC 0A86 4AA1
Copyright 2006 Stefan Esser. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQFEIlt4RDkUzAqGSqERAk9kAJ96iwq93+EeDAMlk5JmRTUUxgkP1gCeKY1v
WZy/+ASNSsw9PqRGLFb1FZs=
=zmaa
-----END PGP SIGNATURE-----
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum