------------------------------------------------------------
- EXPL-A-2006-002 exploitlabs.com Advisory 048 -
------------------------------------------------------------
- MSVC 6.0 run file bug -
AFFECTED PRODUCTS
=================
Microsoft Visual Studio 6.0
http://microsoft.com
Possibly other products referenced in:
http://support.microsoft.com/kb/841189
OVERVIEW
========
Source code project distributions are very popular these days.
Generally authors offer code as a project with source, headers,
and msvc project files if it is a fairly big project. Most users
will simply open up the project.dsw file, ( especialy if it says
to do so in a readme.txt or other compiler instructions ) which
in turn loads the project.dsp files, which provides the compiler
directives.
A malicious attacker could embed commands to be executed in the
project files, and execute any local code of his choosing.
note: this is an implemented feature in MSVC, and should be
considered a bug, not a vulnerability.
IMPACT
======
The impact of this is quite severe, as it is possible to script
commands such as to launch ftp, retrieve and execute a file from
a remote location.
DETAILS
=======
By modifying the .dsp files:
project
settings
custom build
Commands: command to execute
Post-build Step: command to execute
1.a
====
InputPath=.\Release\hello.exe
SOURCE="$(InputPath)"
"hello.exe" : $(SOURCE) "$(INTDIR)" "$(OUTDIR)"
calc
1.b
====
PostBuild_Cmds=notepad.exe
POC
====
http://exploitlabs.com/files/advisories/msvc-featurebug-POC.zip
extract, and open hello.dsw
click "batch build, build" or "rebuild all"
code will execute ( calc.exe and notepad.exe used as an example )
calc.exe = Custom-Build
notepad.exe = PostBuild Commands
SOLUTION
========
vendor contact:
secure@microsoft.com Sept 20, 2005
http://support.microsoft.com/kb/841189 updated Jan 6, 2006
Microsoft provided these URL's as well:
http://msdn.microsoft.com/library/en-us/vsintro7/html/vxurfopenprojectfromwebdialogbox.asp
http://msdn2.microsoft.com/en-us/library/bs2bkwxc.aspx
SUGGESTED PATCH
===============
Include a dialog box that warns the user, before pre and post
build directives can be launched, if the presence of execute
directives exist in the build project files.
CREDITS
=======
This vulnerability was discovered and researched by
Donnie Werner of exploitlabs
mail: wood at exploitlabs.com
mail: morning_wood at zone-h.org
--
web: http://exploitlabs.com
web: http://zone-h.org
http://exploitlabs.com/files/advisories/EXPL-A-2006-002-msvc-featurebug.txt
http://exploitlabs.com/files/advisories/msvc-featurebug-POC.zip
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
