RE: [Full-disclosure] Miscrosoft Registry Editor 5.1/XP/2K long stringkey vulnerability

From: Andre Protas (aprotas_at_eeye.com)
Date: 08/24/05

  • Next message: José María Mateos: "Re: [Full-disclosure] talk.google.com" 
    Date: Wed, 24 Aug 2005 08:57:43 -0700
To: "Igor Franchuk" <sprog@online.ru>, <bugs@securitytracker.com>, <news@securiteam.com>, <full-disclosure@lists.grok.org.uk>, <vuln@secunia.com>

    Confirmed in XP SP2.

     
    Signed,

    Andre Derek Protas
    Security Researcher
    eEye Digital Security
    aprotas eeye com

    -----Original Message-----
    From: full-disclosure-bounces@lists.grok.org.uk
    [mailto:full-disclosure-bounces@lists.grok.org.uk] On Behalf Of Igor
    Franchuk
    Sent: Wednesday, August 24, 2005 12:01 AM
    To: bugs@securitytracker.com; news@securiteam.com;
    full-disclosure@lists.grok.org.uk; vuln@secunia.com
    Subject: [Full-disclosure] Miscrosoft Registry Editor 5.1/XP/2K long
    stringkey vulnerability

    Hello All,

    PRELUDE

    /*
    Registry Element Size Limits
    The following are the size limits for the various registry elements.
    The maximum size of a key name is 255 characters.
    The maximum size of a value name is as follows:
    Windows Server 2003 and Windows XP: 16,383 characters
    Windows 2000: 260 ANSI characters or 16,383 Unicode characters.
    Windows Me/98/95: 255 characters
    Long values (more than 2,048 bytes) should be stored as files with the
    file names stored in the registry.
    This helps the registry perform efficiently. The maximum size of a value
    is as follows:
    Available memory.
    Windows Me/98/95: 16,300 bytes. There is a 64K limit for the total size
    of all values of a key.
    */

    DESCRIPTION

    Microsoft Registry Editor for 2K and XP (Regedt32.exe) has a nice design
    flow
    that is naturally allows to hide registry information from viewing and
    editing even from users with administrative access. (really handful,
    thanks guys)

    POC

    To reproduce the desired behavior:

    - run Regedt32.exe
    - create a key, let it just be
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Empty
    - in this key create any string value with the name exceeding 256
    symbols (260 is the max) or just copy-paste:

    helloworldhelloworldhelloworldhelloworldhelloworldhelloworldhelloworldhe
    lloworldhelloworldhelloworldhelloworldhelloworldhelloworldhelloworldhell
    oworldhelloworldhelloworldhelloworldhelloworldhelloworldhelloworldhellow
    orldhelloworldhelloworldhelloworldhelloworl

    Press F5 (refresh) and you will see how the key magically disappears.

    Now create ANY key within
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Empty
    and press refresh again - it will NOT BE SEEN by regedt32.

    PRACTICE
    There is a tremendous implementation field for this behavior.

    TESTED
     On XP SP2 Eng, SP1 and 2K RUS. The testing is by no
     means complete but I hope it is working on all 2K and XP systems.
     Sorry if it is not.

    SUGGESTED FIX
    Make it possible to mange visibility by specifying (_?_) (_$_) and
    (_._) in the key names. 

    -- 
www.rol.ru
Best regards,
 Igor                          mailto:sprog@online.ru
 
NOW SOME REALLY SERIOUS STUFF
Q:
  What does boot progress mean?
A:
  Bugs, they're warming up.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
  • Next message: José María Mateos: "Re: [Full-disclosure] talk.google.com"

    Relevant Pages

    • Re: PolAdtEv
      ... I did try posting a question about this on ... entire array instead of just the first 254 characters? ... >This is more a WMI question and not SMS related. ... tried tojsut get the data from the registry into ...
      (microsoft.public.sms.inventory)
    • RE: Win2000 creating new user profile while old still exists
      ... See if a registry key that exceeds 259 characters exists in the ... exceeds 259 characters exists in the HKEY_CLASSES_ROOT registry hive. ... Event Type: Information ... Event Source: MSExchangeSA ...
      (microsoft.public.win2000.general)
    • Re: Importing Excel files with columns > 255 chars
      ... I am getting error "Text was truncated or one or more characters had no ... or similar string manipulation to get the required maximum length. ... to change the column width of Error output columns, ... the following registry key when reading the spreadsheet: ...
      (microsoft.public.sqlserver.dts)
    • Re: Mobile applications are unicode, why file explorer not showing UTF16 files?
      ... shows the characters alright already, no registry change made... ... only depend on the font. ... characters that aren't included in ordinary Japanese character sets, ...
      (microsoft.public.pocketpc.developer)
    • [Full-disclosure] Miscrosoft Registry Editor 5.1/XP/2K long string key vulnerability
      ... The following are the size limits for the various registry elements. ... The maximum size of a key name is 255 characters. ... Windows Server 2003 and Windows XP: ...
      (Full-Disclosure)