X41 D-Sec GmbH Security Advisory X41-2019-001: Heap-based buffer overflow in Thunderbird
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
X41 D-Sec GmbH Security Advisory: X41-2019-001
Heap-based buffer overflow in Thunderbird
=
Severity Rating: High
Confirmed Affected Versions: All versions affected
Confirmed Patched Versions: Thunderbird ESR 60.7.XXX
Vendor: Thunderbird
Vendor URL: https://www.thunderbird.net/
Vendor Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1553814
Vector: Incoming mail with calendar attachment
Credit: X41 D-SEC GmbH, Luis Merino
Status: Public
CVE: CVE-2019-11704
CWE: 122
CVSS Score: 7.8
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O
Advisory-URL:
https://www.x41-dsec.de/lab/advisories/x41-2019-002-thunderbird
Summary and Impact
==
A heap-based buffer overflow has been identified in the Thunderbird
email client. The issue is present in the libical implementation, which
was forked from upstream libical version 0.47.
The issue can be triggered remotely, when an attacker sends an specially
crafted calendar attachment and does not require user interaction. It
might be used by a remote attacker to crash or gain remote code
execution in the client system.
This issue was initially reported by Brandon Perry here:
https://bugzilla.mozilla.org/show_bug.cgi?id=1280832
and fixed in libical upstream, but was never fixed in Thunderbird.
X41 did not perform a full test or audit on the software.
Product Description
===
Thunderbird is a free and open source email, newsfeed, chat, and
calendaring client, that's easy to set up and customize.
Analysis
A heap-based buffer overflow in icalvalue.c
icalmemory_strdup_and_dequote() can be triggered while parsing a
calendar attachment containing a malformed or specially crafted
string.
~~~
static char *icalmemorystrdupanddequote(const char *str)
{
char *out = (char *)malloc(sizeof(char) * strlen(str) + 1);
char *pout = out;
// ...
for (p = str; *p!=0; p++){
if( *p == '\')
{
p++;
// ...
else
{
*pout = *p;
}
}
~~~
Bounds checking in `icalmemorystrdupanddequote()can be bypassed when the
inputp` ends with a backslash, which enables an attacker to read out
of bounds of the input buffer and writing out of bounds of a
heap-allocated
output buffer.
The issue manifests in several ways, including out of bounds read and
write, null-pointer dereference and frequently leads to heap corruption.
It is expected that an attacker can exploit this vulnerability to
achieve remote code execution.
Proof of Concept
A reproducer EML file can be found in:
https://github.com/x41sec/advisories/tree/master/X41-2019-001
Workarounds
===
A fix is available from upstream. Alternatively, libical can be replaced
by icaljs, a JavaScript implementation of ical parsing, by setting
calendar.icaljs = true in Thunderbird configuration.
Timeline
2016-06-19 Issue reported by Brandon Perry to the vendor
2019-05-23 Issue reported by X41 D-SEC to the vendor
2019-05-23 Vendor reply
2019-06-12 CVE IDs assigned
2019-06-13 Patched Version released
2019-06-13 Advisory released
About X41 D-SEC GmbH
X41 is an expert provider for application security services.
Having extensive industry experience and expertise in the area of
information security, a strong core security team of world class
security experts enables X41 to perform premium security services.
Fields of expertise in the area of application security are security
centered code reviews, binary reverse engineering and vulnerability
discovery.
Custom research and a IT security consulting and support services are
core competencies of X41.
-BEGIN PGP SIGNATURE-
iQIzBAEBCAAdFiEEpwxVTgxAIcUvTugIo5Klpg50CxAFAl0CtFQACgkQo5Klpg50
CxDziQ/+JVKmkCHu3UXeNTrf3nFAcg3pzopaADVMK4yo7P/iQW/HMtvlz3sbi/ND
8nkTzXjPwTXmPZqrcr8X28lsffx2wu4ehIZNp2izTkfQkbIeA0co1bM2KhGJU+p+
GQP8yGsVi00+UvQfd5KxB4ydc7/Q4nTFH325yx7D4OHW/rDuETt5p8h1h7zmFBW+
SV09t4qQQx8HeWj2pQS6wF6pWo80/nqJbS8f540PQ+XTysvYsflxiybAqYK2mW2j
QzvjT/YosR39JCMHBKscptwVgJFT6b2DsSq+Lt+1BTn0Ef0XoIY/rMvLFX1ww8HK
nsViFPjtyhkX7CftIjZK6y4oK4nKsgyDiOieNKodfkr1jTmipUIIjwtGM99pKcv2
wNDY4ySB7RSbW+W+yrWc75vEX+Ev1enXkeM6xcJiPO0CiWfceZpVzZVcjoFqt9H6
57Uy10OMzZDi3reIMsMs3SxpRyXQqcyjlPkk7PlkzHx2XjAMKqwW6t5QZwMpIHrm
M4BQOzxz9UuhnfZI80ZmJhYCh9zOOdjmJXGxOp5cB1GSXjQQ7PH/0aqTbfI0Hp+b
uxqXsxBJ0YTO0qhHluuPkInqLEKlewHvNT4P5YE7US3TNCHPuei7P3zTq7fqSPjW
sgj9XXjf4cbB7N+txXnq55BpHemGKAd4spgvQvo0L35m2RribBs=
=sYWR
-END PGP SIGNATURE-
[SECURITY] [DSA 4462-1] dbus security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4462-1 secur...@debian.org https://www.debian.org/security/ Salvatore Bonaccorso June 13, 2019 https://www.debian.org/security/faq - - Package: dbus CVE ID : CVE-2019-12749 Debian Bug : 930375 Joe Vennix discovered an authentication bypass vulnerability in dbus, an asynchronous inter-process communication system. The implementation of the DBUS_COOKIE_SHA1 authentication mechanism was susceptible to a symbolic link attack. A local attacker could take advantage of this flaw to bypass authentication and connect to a DBusServer with elevated privileges. The standard system and session dbus-daemons in their default configuration are not affected by this vulnerability. The vulnerability was addressed by upgrading dbus to a new upstream version 1.10.28 which includes additional fixes. For the stable distribution (stretch), this problem has been fixed in version 1.10.28-0+deb9u1. We recommend that you upgrade your dbus packages. For the detailed security status of dbus please refer to its security tracker page at: https://security-tracker.debian.org/tracker/dbus Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-annou...@lists.debian.org -BEGIN PGP SIGNATURE- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl0Crf5fFIAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0QQuA//SREVvaxhfUhUiAI8h/WVf68kOoU0HP1eC7O27D8HJRkMpiHL8bGyZmZ/ J6b2JUrLSYI7L9LZbmz3u9Nw637BRxZXMH1++lg8AuvNahc4kq5NjU+T8iMKeNNr bTuyF4GfiniwfWMI1ekaI3o7DUQLDLGpyAn2x+0jJxqH3EUPMky9YTKy3u/duE7B ZjR05Pu6W/32AELUlPBzhKABtZh+CUICJZ6aBL/9oF7ra3TcTBwTFXADqF7Jjg1W 4fZ6A0UYFBO7WRdlmuVLX9ugiy60T3DZRFmpmlRYBelExyKXK7/DcCBvpXsdsE8G 3gXmIUDR1UkG6J7zM8CGSn4ewYtuoY3L0qTM/v+EnibAdjhrDCwoWNVZb7kd3aXe OIg+iMvAlAx4ZlaplCZ+fvwzduD6iiok07tZvO6Gltw9mMZdJZtfkMdtz9EvyPQQ y8cLHArxziK2ZBscZKNuhsLF2WCxGgqGMzjA/7N4pRkWGO3ptCCc1zlzyt9xpW8r uS4Sly0b3t6OzsMhWGMxkAcxlgpizsTn2fBBjNMJTdnqLVQ/C8PreNdpGPA5FSfE 1ITpoI3av51474jcMkER/ggDfzF/T7Nr3+FhtDz3CYcRCc2Gj2UxR2OC7rLVgnFI 7RUubl1cvSie+IkI0L0aaBacB7QvpLmo0PcgaS7ZozyXgowNQSY= =2JS9 -END PGP SIGNATURE-
X41 D-Sec GmbH Security Advisory X41-2019-001: Heap-based buffer overflow in Thunderbird
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256
X41 D-Sec GmbH Security Advisory: X41-2019-001
Heap-based buffer overflow in Thunderbird
=
Severity Rating: High
Confirmed Affected Versions: All versions affected
Confirmed Patched Versions: Thunderbird ESR 60.7.XXX
Vendor: Thunderbird
Vendor URL: https://www.thunderbird.net/
Vendor Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1553814
Vector: Incoming mail with calendar attachment
Credit: X41 D-SEC GmbH, Luis Merino
Status: Public
CVE: CVE-2019-11704
CWE: 122
CVSS Score: 7.8
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O
Advisory-URL:
https://www.x41-dsec.de/lab/advisories/x41-2019-002-thunderbird
Summary and Impact
==
A heap-based buffer overflow has been identified in the Thunderbird
email client. The issue is present in the libical implementation, which
was forked from upstream libical version 0.47.
The issue can be triggered remotely, when an attacker sends an specially
crafted calendar attachment and does not require user interaction. It
might be used by a remote attacker to crash or gain remote code
execution in the client system.
This issue was initially reported by Brandon Perry here:
https://bugzilla.mozilla.org/show_bug.cgi?id=1280832
and fixed in libical upstream, but was never fixed in Thunderbird.
X41 did not perform a full test or audit on the software.
Product Description
===
Thunderbird is a free and open source email, newsfeed, chat, and
calendaring client, that's easy to set up and customize.
Analysis
A heap-based buffer overflow in icalvalue.c
icalmemory_strdup_and_dequote() can be triggered while parsing a
calendar attachment containing a malformed or specially crafted
string.
~~~
static char *icalmemorystrdupanddequote(const char *str)
{
char *out = (char *)malloc(sizeof(char) * strlen(str) + 1);
char *pout = out;
// ...
for (p = str; *p!=0; p++){
if( *p == '\')
{
p++;
// ...
else
{
*pout = *p;
}
}
~~~
Bounds checking in `icalmemorystrdupanddequote()can be bypassed when the
inputp` ends with a backslash, which enables an attacker to read out
of bounds of the input buffer and writing out of bounds of a
heap-allocated
output buffer.
The issue manifests in several ways, including out of bounds read and
write, null-pointer dereference and frequently leads to heap corruption.
It is expected that an attacker can exploit this vulnerability to
achieve remote code execution.
Proof of Concept
A reproducer EML file can be found in:
https://github.com/x41sec/advisories/tree/master/X41-2019-001
Workarounds
===
A fix is available from upstream. Alternatively, libical can be replaced
by icaljs, a JavaScript implementation of ical parsing, by setting
calendar.icaljs = true in Thunderbird configuration.
Timeline
2016-06-19 Issue reported by Brandon Perry to the vendor
2019-05-23 Issue reported by X41 D-SEC to the vendor
2019-05-23 Vendor reply
2019-06-12 CVE IDs assigned
2019-06-13 Patched Version released
2019-06-13 Advisory released
About X41 D-SEC GmbH
X41 is an expert provider for application security services.
Having extensive industry experience and expertise in the area of
information security, a strong core security team of world class
security experts enables X41 to perform premium security services.
Fields of expertise in the area of application security are security
centered code reviews, binary reverse engineering and vulnerability
discovery.
Custom research and a IT security consulting and support services are
core competencies of X41.
-BEGIN PGP SIGNATURE-
iQIzBAEBCAAdFiEEpwxVTgxAIcUvTugIo5Klpg50CxAFAl0CsOUACgkQo5Klpg50
CxA8/A/+KajTIDyZwSInPe0uftrEG/c+DNJLQfpH53sBH4qI9G8F+FPquEibdCEm
WIXlbdxxo7iVGkBUxws3+aqOXYtBYRGUQvSMDxcM9bmLWkzIOWCZ7RW4h4KOngWu
NiWqFkdpRLxSjHgEFn3eegvcnwEmpOlV4eBw5oY1rTFCg44hbrLXTKEZqOOVFII/
n754abauYhol2SezeuJL2Du1hf7n0e4T6DPdYsrwB4+3XwAdp6n86hy9DdXniqdk
XvJ2WFTKPljkt2suHmkM28zx8q52O5kMIK0Szc5MVZRiFIrPNh/oYFkCoBVYTqFQ
/ui0YJZOy8O6mA1l7j7A3I+t3DSUu4Cs0fCVCqrBVKm1LNcmnWIyDrGRCpY5WOTI
S8lllwEeUv5UoSaoPAWIXhvo1J4ISUX0qoNWNqtRENJCXjZvsmOvZkwWy0bMdu5g
1iWZ3Ro/hx7eAbakWKPrzRdnLI7wz7bBcnm3BSY4gelAhtTMLds/OSplDUpYL1cI
KRMsnosf2CBiRGlGqdpXVlXcsmi3dozRY7q87Kxh58x50efGTqYQ+yAmR1pMrQgH
O0yWaspEQOnqoPiw9dvT3gTqopk0qNdPWwbr599NAVOP5d0H3AKyeJxzTzVUIsxg
Jynb/E4hQxgyYN8tSqH/2SXqmXiOPJrJgLt0O4KmKVjMwvnS/OU=
=3l5l
-END PGP SIGNATURE-
SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series
SEC Consult Vulnerability Lab Security Advisory < 20190612-0 > === title: Multiple vulnerabilities product: WAGO 852 Industrial Managed Switch Series vulnerable version: 852-303: https://www.wago.com found: 2019-03-08 by: T. Weber (Office Vienna) IoT Inspector SEC Consult Vulnerability Lab An integrated part of SEC Consult Europe | Asia | North America https://www.sec-consult.com === Vendor description: --- "New ideas are the driving force behind our success WAGO is a family-owned company headquartered in Minden, Germany. Independently operating for three generations, WAGO is the global leader of spring pressure electrical interconnect and automation solutions. For more than 60 years, WAGO has developed and produced innovative products for packaging, transportation, process, industrial and building automation markets amongst others. Aside from its innovations in spring pressure connection technology, WAGO has introduced numerous innovations that have revolutionized industry. Further ground-breaking inventions include: the WAGO-I/O-SYSTEM®, TOPJOB S® and WALL-NUTS®." Source: http://www.wago.us/wago/ Business recommendation: SEC Consult recommends to immediately apply the available patches from the vendor. A thorough security review should be performed by security professionals to identify further potential security issues. Vulnerability overview/description: --- The industrial managed switch series 852 from WAGO is affected by multiple vulnerabilities such as old software components embedded in the firmware. Furthermore, hardcoded password hashes and credentials were also found by doing an automated scan with IoT Inspector. Two vulnerabilities (CVE-2017-16544 and CVE-2015-0235) were verified by emulating the device with the MEDUSA scaleable firmware runtime. The validity of the password hashes and the embedded keys were also verified by emulating the device. 1) Known BusyBox Vulnerabilities The used BusyBox toolkit in version 1.12.0 is outdated and contains multiple known vulnerabilities. The outdated version was found by IoT Inspector. One of the discovered vulnerabilities (CVE-2017-16544) was verified by using the MEDUSA scaleable firmware runtime. 2) Known GNU glibc Vulnerabilities The used GNU glibc in version 2.8 is outdated and contains multiple known vulnerabilities. The outdated version was found by IoT Inspector. One of the discovered vulnerabilities (CVE-2015-0235, "GHOST") was verified by using the MEDUSA scaleable firmware runtime. 3) Hardcoded Credentials (CVE-2019-12550) The device contains hardcoded users and passwords which can be used to login via SSH and Telnet. 4) Embedded Private Keys (CVE-2019-12549) The device contains hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches to the embedded private key. Proof of concept: - 1) Known BusyBox Vulnerabilities BusyBox version 1.12.0 contains multiple CVEs like: CVE-2013-1813, CVE-2016-2148, CVE-2016-6301, CVE-2011-2716, CVE-2011-5325, CVE-2015-9261, CVE-2016-2147 and more. The BusyBox shell autocompletion vulnerability (CVE-2017-16544) was verified on an emulated device. A file with the name "\ectest\n\e]55;test.txt\a" was created to trigger the vulnerability. --- # ls "pressing " test ]55;test.txt # --- 2) Known GNU glibc Vulnerabilities GNU glibc version 2.8 contains multiple CVEs like: CVE-2010-0296, CVE-2010-3856, CVE-2012-4412, CVE-2014-4043, CVE-2014-9402, CVE-2014-9761, CVE-2014-9984, CVE-2015-1472 and more. The gethostbyname buffer overflow vulnerability (GHOST) was checked with the help of the exploit code from https://seclists.org/oss-sec/2015/q1/274. It was compiled and executed on the emulated device to test the system. 3) Hardcoded Credentials (CVE-2019-12550) The following credentials were found in the 'passwd' file of the firmware: root No password is set for the account [EMPTY PASSWORD] admin By using these credentials, it's possible to connect via Telnet and SSH on the emulated device. Example for Telnet: --- [root@localhost ~]# telnet 192.168.0.133 Trying 192.168.0.133... Connected to 192.168.0.133. Escape character is '^]'. L2SWITCH login: root Password: ~ #
