CYBSEC - Security Advisory: Microsoft Windows DHCP Client Service Remote Buffer Overflow

2006-08-30T00:00:00
ID SECURITYVULNS:DOC:14077
Type securityvulns
Reporter Securityvulns
Modified 2006-08-30T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

(The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSEC-Security_Pre-Advisory_Microsoft_Windows_DHCP_Client_Service_Remote_Buffer_Overflow.pdf)

This advisory contains the full-detailed information regarding the vulnerability described in "CYBSEC Security Pre-Advisory: Microsoft Windows DHCP Client Service Remote Buffer Overflow".

CYBSEC S.A. www.cybsec.com

Advisory Name: Microsoft Windows DHCP Client Service Remote Buffer Overflow

Vulnerability Class: Stack Buffer Overflow

Release Date: 08/29/2006

Affected Platforms:

  • Microsoft Windows 2000 (<= SP4)
  • Microsoft Windows XP (<= SP2)
  • Microsoft Windows 2003 (<= SP1)

Local / Remote: Remote

Severity: High

Author: Mariano Nuñez Di Croce

Vendor Status:

  • Confirmed, update released.

Reference to Vulnerability Disclosure Policy:

http://www.cybsec.com/vulnerability_policy.pdf

Vulnerability Description:

A remote buffer overflow vulnerability has been identified in Microsoft Windows DHCP-Client Service.

Technical Details:

The vulnerability specifically exists in the way the dhcpcsvc.dll system library processes DHCP messages.

To extend the limit of 255 bytes defined by the length octet of the DHCP Option Field, Microsoft uses the private Option Code 0xFA (250), allowing the use of larger option values.

Therefore, a client trying to obtain its IP information may receive a DHCPACK packet with the following structure defined, after the MAGIC_COOKIE:


2F FF [255 bytes] FA 09 [8 bytes] 00


In the packet previously described, a NetBIOS over TCP/IP Scope option is being used, consisting of 264 bytes (including the NULL), effectively extending the limit of 255 bytes per Option.

The use of this Private Option Code is not restricted to be used only once after a known Option Code, so the following structure can also be used:


2F FF [255 bytes] FA FF [255 bytes] FA FF [255 bytes] ... FA FF [254 bytes] 00


Option Code 0x2F (NetBIOS over TCP/IP Scope ) was used for our internal proof-of-concept but other Option Codes can also be used.

Once the client receives this DHCPACK message, an option-reassembling process is undertaken so that intermediate "0xFA"s and Length octets are removed. In this state the requesting client has an N bytes (N > 255) valid DHCP option value, which will now be saved in the stack, after trying to perform a Unicode translation process (Windows 2000):

In function DhcpRegSaveOptionAtLocation 2516 bytes of stack space is reserved:


55 PUSH EBP 8BEC MOV EBP,ESP 81EC D4090000 SUB ESP,9D4


Then, the function DhcpOemToUnicode is called with the following arguments:


8D85 2CF6FFFF LEA EAX, DWORD PTR SS:[EBP-9D4]
50 PUSH EAX ; PUNICODE_STRING destination buffer 56 PUSH ESI ; POEM_STRING buffer received E8 3E010000 CALL DhcpOemToUnicode


In this function some values are calculated and passed to the DhcpOemToUnicodeN function:


0FB745 F8 MOVZX EAX,WORD PTR SS:[EBP-8] ; POEM_STRING->Length 8D4400 02 LEA EAX,DWORD PTR DS:[EAX+EAX+2] ; LEN = (POEM_STRING->Length+1)*2 50 PUSH EAX FF75 0C PUSH DWORD PTR SS:[EBP+C] ; PUNICODE_STRING buffer FF75 08 PUSH DWORD PTR SS:[EBP+8] ; POEM_STRING buffer E8 04000000 CALL DhcpOemToUnicodeN


In DhcpOemToUnicodeN, the following code is executed:


8B45 10 MOX EAX,DWORD PTR SS:[EBP+10] ; Argument 3 (LEN) 8B75 0C MOV ESI,DWORD PRT SS:[EBP+C] ; PUNICODE_STRING->MaxLength 03C0 ADD EAX, EAX 85F6 TEST ESI,ESI 66:8945 FA MOV WORD PTR SS:[EBP-6], EAX ; PUNICODE_STRING->MaxLength = LEN*2


As can be seen, the MaximumLength member of the UNICODE_STRING structure is calculated based on the length of the OEM string provided (which, by the way, has already been multiplied by two).

Finally, the following call to ntdll.RtlOemStringToUnicodeString is made:


8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10] ; POEM_STRING 6A 00 PUSH 0 ; 0 = Do NOT Allocate 50 PUSH EAX 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8] ; PUNICODE_STRING 50 PUSH EAX FF15 54103477 CALL ntdll.RtlOemStringToUnicodeString


The call to ntdll.RtlOemStringToUnicodeString specifies that the buffer is already allocated by the caller. Therefore, this function will simply translate the supplied POEM_STRING->Buffer, storing the resulting characters in PUNICODE_STRING->Buffer, having done no bound checking.

This introduces the possibility of overflowing the stack space reserved for this buffer and gain control of execution modifying the SEH handler.

Impact:

The dhcpcsvc.dll is loaded by services.exe in Windows 2000 and by svchost.exe in Windows XP/2003. As both these services run with SYSTEM privileges, an exploitation of this issue would allow Remote Code Execution as SYSTEM over vulnerable systems.

Solutions:

Microsoft has referred this vulnerability as MS06-036 and developed a patch to address it. Users should upgrade their system through Microsoft Windows Update facility. More information can be found in Microsoft KB914388.

Vendor Response:

  • 12/26/2005: Initial Vendor Contact.
  • 01/19/2006: Vendor Confirmed Vulnerability.
  • 07/11/2006: Vendor Releases Update.
  • 07/11/2006: Pre-Advisory Public Disclosure.
  • 08/29/2006: Advisory Public Disclosure.

Thanks:

Special thanks go to Andres Riancho.

Contact Information:

For more information regarding the vulnerability feel free to contact the author at mnunez {at} cybsec.com.

For more information regarding CYBSEC: www.cybsec.com (c) 2006 - CYBSEC S.A. Security Systems -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFE9HgHbbZGNCayCJkRAkSLAJ9vyk8CkGFXpg6BrgAEtWTU7IhFmQCfSWoU 7XDCfy+qUNTY2u3EBvVZYG4= =YZsO -----END PGP SIGNATURE-----