The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
PocketPC MMS Code Injection/Execution Vulnerability
------------------------------------------------------------------------
SUMMARY
Multiple buffer overflows in MMS parsing code, allow denial-of-service and
remote code injection/execution via MMS.
DETAILS
Vulnerable Systems:
* MMS Composer version 1.5.5.6
* MMS Composer version 2.0.0.13
1.0) UDP port 2948 open on all interfaces
Devices accept WAPPush via UDP port 2948 on the wireless LAN (Wi-Fi)
interface. This is unnecessary and can be used for Denial-of-Service
attacks.
2.0) Multiple buffer overflows in MMS message parser
MMS Message parts:
2.1) M-Notification.ind
2.2) M-Retrieve.conf (Header)
2.3) M-Retrieve.conf (Body)
2.4) SMIL parser (Message display function)
2.1) Parser for M-Notification.ind
Buffer overflows in handlers for the following header fields:
1) TransactionID
2) Subject
3) ContentLocation
Application crashes. Non-critical. Denial-of-Service attack possible.
Exploitable via UDP port 2948.
Categorization: MEDIUM (denial-of-service via wireless LAN)
2.2) Parser for M-Retrieve.conf (Header)
Buffer overflows in handlers for the following header fields:
1) Subject
2) Content-Type (can overwrite return address on stack)
3) start-info parameter of content-type
Application crashes.
Categorization: LOW (exploitation requires control of MMS infrastructure)
2.3) Parser for M-Retrieve.conf (Body)
Buffer overflows in handlers for the following body fields:
Multi-Part Entry header:
1) Content-Type
2) Content-ID
3) ContentLocation
In all cases it is possible to overwrite the return address.
Categorization: LOW (exploitation requires control of MMS infrastructure)
2.4) Parser for SMIL (Message display function)
Transported in: M-Retrieve.conf body content
Buffer overflows in handlers for the following parameters:
1) ID parameter of REGION tag ID="CONTENT" CONTENT is copied into
stack-based variable, CONTENT can be arbitrary long.
2) REGION parameter of TEXT tag REGION="CONTENT" CONTENT is copied into
stack-based variable, CONTENT can be arbitrary long.
Both overflows allow one to overwrite the return address on the stack.
Both are exploitable and we were able to create a proof-of-concept
exploit. The exploit is triggered by viewing the malicious MMS message
(this is different from other exploits that require substantial user
interaction -- e.g., to install a program).
Overflow happens after 300 bytes in version 1.5.5.6 and after 400 bytes in
version 2.0.0.13.
Categorization: CRITICAL (REMOTE CODE EXECUTION)
Disclosure Time Line:
July 12. 2006 : Vulnerability Report to ArcSoft and Microsoft
July 19. 2006 : Reply by ArcSoft and Microsoft
Aug. 02. 2006 : Vendor Provides Bug Fix to OEMs
Aug. 04. 2006 : Public Disclosure at DEFCON-14
ADDITIONAL INFORMATION
The information has been provided by <mailto:mulliner@cs.ucsb.edu> Collin
Mulliner.
The original article can be found at: <http://www.mulliner.org/pocketpc/>
http://www.mulliner.org/pocketpc/
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
