Document Title: =============== Microsoft Skype v7.2, v7.35 & v7.36 - Stack Buffer Overflow Vulnerability References (Source): ==================== http://ift.tt/2sIcu5a MSRC ID: 38778 TRK ID: 0461000724 Vulnerability Magazine: http://ift.tt/2sd0jtz Video: http://ift.tt/2sd4HbQ Release Date: ============= 2017-06-26 Vulnerability Laboratory ID (VL-ID): ==================================== 2071 Common Vulnerability Scoring System: ==================================== 7.2 Vulnerability Class: ==================== Buffer Overflow Current Estimated Price: ======================== 25.000€ - 35.000€ Product & Service Introduction: =============================== Skype is an instant messaging app that provides online text message and video chat services. Users may transmit both text and video messages and may exchange digital documents such as images, text, and video. Skype allows video conference calls. Skype allows users to communicate over the Internet by voice using a microphone, by video using a webcam, and by instant messaging. Skype-to-Skype calls to other users are free of charge, while calls to landline telephones and mobile phones (over traditional telephone networks) are charged via a debit-based user account system called Skype Credit. Some network administrators have banned Skype on corporate, government, home, and education networks, citing such reasons as inappropriate usage of resources, excessive bandwidth usage and security concerns. Skype originally featured a hybrid peer-to-peer and client–server system. Skype has been powered entirely by Microsoft-operated supernodes since May 2012. (Copy of the Homepage: http://ift.tt/1nU1neS ) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered a stack buffer overflow vulnerability in the official Microsoft Skype v7.2, v7.3.5.103 & v7.3.6 software. Vulnerability Disclosure Timeline: ================================== 2017-05-16: Researcher Notification & Coordination (Benjamin Kunz Mejri) 2017-05-17: Vendor Notification (Microsoft Security Response Center - MSRC) 2017-05-24: Vendor Response/Feedback (Microsoft Security Response Center - MSRC) 2017-06-08: Vendor Fix/Patch (Microsoft Service Developer Team) 2017-06-25: Security Acknowledgements (Microsoft Security Response Center - MSRC) 2017-06-26: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Microsoft Corporation Product: Skype - Software Client 7.2, 7.35.103 & 7.36.0.101 & 7.36.0.150 Exploitation Technique: ======================= Local Severity Level: =============== High Technical Details & Description: ================================ A remote and local stack buffer overflow vulnerability has been discovered in the official Microsoft Skype v7.2, v7.3.5 & v7.3.6 software client. The security vulnerability allows to crash the software application with an unexpected exception error, to overwrite the active process registers to execute own malcious codes. The skype software is using a dll in case of a copy request on the local systen. We place a picture in our clipboard (we take a screenshot in this example), this needs to be copied from a remote desktop system. This can be pasted into the local skype message box, by the paste function. Then the picture is taken from the clipboard (which is the rdp remote clipboard content) and successfully copies it into the message box. The security vulnerability is located in the `clipboard format` function of the skype software. Attackers are able to use a remote computer system with a shared clipboard, to provoke a stack buffer overflow on transmittion to skype. The issue affects the `MSFTEDIT.DLL` dynamic link library of the windows8 (x86) operating system. The limitation of the transmitted size and count for images via print of the remote session clipboard has no secure limitations or restrictions. Attackers are able to crash the software with one request to overwrite the eip register of the active software process. Thus allows local or remote attackers to execute own codes on the affected and connected computer systems via the skype software. The attacker opens a local computer system connection and establishes a RDP connection to another system. First the attacker enables the clipboard function for the remote session. This is possible by the basic rdp settings in the `Local Devices & Resources settings. Then the attacker moves with a click into the rdp session window and pushes the print key. A screenshot is made of the remote session, that is loaded to the local system cache of the first computer system that the attacker uses. Then the attacker moves back to the local system into the conversation of skype and copypastes the screenshot of the clipboard (print) to the message body. A clipboard error occurs because of the unknown format size and the software crashs with several uncaught access violations or unfiltered exceptions for both parties. The software is not terminated and allows to read every dll error by line with offset. The error and critical crashs are captured by the software internal dev log called gilasterr.log file. The gilasterr.log file captures internal information of the software in case of critical errors for the skype developer teams. During the exploitation process the gilasterr.log file captured the loop crashs and overwrite of the eip register as reference. The active offsets allowed us to define a new address to compromise the targeted local or remote computer system. In a software update of the v7.2, v7.3.5 & v7.3.6 version of skype, a limitation has been implemented for the clipboard function. Due to the implementation, a misconfiguration was included by the developers. The cut function allows to paste the image in raw format back to the message box. After the limitation was implemented for the pasted image counts and for the byte size of the clipboard, the attacker is still able to exploit the issue. Therefore an attacker uses the developer flaw that should fix the new zero-day vulnerability. The attacker copies the content via remote session of the clipboard via cache, then he uses the cut ability of skype with the context menu and repaste the input again. After that the images are getting transfered in raw format as text value of the skype code [image] by repasting them to the message box query, the vulnerability can be triggered again and the limiation of size and count is bypassed. The successful attack scenario is not limited to manual exploitation only. Attackers can locally prepare the cache and clipboard of a computersystem to exploit the connected remote party computer system using skype. The security risk of the skype vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.2. Exploitation of the buffer overflow software vulnerability requires no user interaction and only a low privilege skype user account. Successful exploitation of the buffer overflow vulnerability results in system and process compromise by an overwrite of the registers. Vulnerable Software Client(s): [+] Microsoft Skype v7.3.6 [+] Microsoft Skype v7.3.5.103 [+] Microsoft Skype v7.2 Vulnerable Function(s): [+] clipboard (remote session) Affected Library: [+] MSFTEDIT.DLL Proof of Concept (PoC): ======================= The buffer overflow vulnerability can be exploited by local and remote attackers without user interaction and with low privileged skype user account. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Install Skype to your windows xp, windows 7 or windows 8 computer system 2. Add a first test contact and use another computer to connect to ip (separate ip and connection) 3. Accept the add request for further communication to both accounts 4. Now, the attacker opens for example a remote desktop session to another system of the first computer for reproduce Note: Activate in the RDP session the clipboard for copy to share with the local connected computer system 5. Connect via RDP to the new computer system 6. Use the print button to make a screenhot Note: The data is stored in the cache because of the transmit to the other system 7. Move now back to the regular system without closing the rdp connection 8. Copy the cipboard content inside of the message box Note: In some cases this already causes the main crash but sometimes the message needs to be delivered to crash on interaction 9. The software crashs and the connected client as well several uncaught and unexpected or unknown errors occur Note: At that point the attacker is able to overwrite the register of the software process to gain higher privileges 10. Successful reproduce of the buffer overflow vulnerability in the skype software! Note: The rdp software allows to use the clipboard function to transmit data to the local system. In case of a transmittion via skype by a copy of the local system screen via the print key, it is possible to finally exploit the vulnerability. The replace of the screen via print to transmit for example large unicode payloads works as well.
Source: Gmail -> IFTTT-> Blogger
No comments:
Post a Comment