[NT] ActivePerl PerlIS.dll Remote Buffer Overflow Vulnerability

From: support@securiteam.com
Date: 11/18/01 

From: support@securiteam.com
To: list@securiteam.com
Subject: [NT] ActivePerl PerlIS.dll Remote Buffer Overflow Vulnerability
Message-Id: <20011118214313.AFF8C138BF@mail.der-keiler.de>
Date: Sun, 18 Nov 2001 22:43:13 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  ActivePerl PerlIS.dll Remote Buffer Overflow Vulnerability
------------------------------------------------------------------------

SUMMARY

The NSFOCUS Security Team has found an exploitable buffer overflow
vulnerability in the dynamic link library perlIS.dll of ActivePerl. The
overflow occurs whenever it handles an overly long filename. Exploitation
of this vulnerability would allow an attacker to execute arbitrary code.

DETAILS

Vulnerable systems:
ActiveState ActivePerl 5.6.1.629 and earlier versions

Immune systems:
ActiveState ActivePerl 5.6.1.630

ActivePerl is a binary package of Perl for Linux, Solaris or Windows
developed by ActiveState. ActivePerl for Windows utilizes a dynamic link
library called perlIS.dll, which is a ISAPI extension to that provides a
Perl interface

PerlIS.dll handles Perl script request sent to it by the user without
adequate length checking of the provided filename. If an attacker sends an
overlong URL request, PerlIS would call the strcpy() function and copy the
provided filename to a stack buffer, which would trigger a buffer
overflow. With well-crafted URL request, the attacker is able to execute
arbitrary code.

Exploiting this vulnerability successfully, would yield an attack with
access of IWAM_machinename account under IIS 5.0 and Local SYSTEM
privileges under IIS 4.0.

Exploit:
$ lynx http://host/cgi-bin/`perl -e 'print "A" x 360'`.pl

Would result in:
The remote procedure call failed.

Workaround:
Edit "perlIS.dll" ISAPI extension in Internet Service Manager and check
"Check that file exists" option.

Vendor status:
Latest version of ActivePerl is available at:
 <http://www.activestate.com/Products/ActivePerl/download.plex>
http://www.activestate.com/Products/ActivePerl/download.plex

ADDITIONAL INFORMATION

The information has been provided by <mailto:security@nsfocus.com>
Nsfocus Security Team.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NEWS] ActivePerl Leaks True Path
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ActiveState's quality-assured distribution of Perl, available for Linux, ... ActivePerl contains the Perl language, ... is sent to the web server, the Perl interpreter ...
    (Securiteam)
  • [UNIX] Remote Buffer Overflow Vulnerability in BSD Line Printer Daemon
    ... Remote Buffer Overflow Vulnerability in BSD Line Printer Daemon ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ...
    (Securiteam)
  • Re: Casestudy abt how to exploit vulnerabilities
    ... OpenSSL SSLv2 Malformed Client Key Remote Buffer Overflow Vulnerability ... Concerned about Web Application Security? ... vulnerability management needs. ...
    (Pen-Test)
  • Re: AT&T to limit unlimited data plans to 5GB a month?
    ... US-CERT Vulnerability Note VU#112179 ... Apple QuickTime RTSP Response message Reason-Phrase buffer overflow ... According to Bruce Schneier, "Security is a process, not a product." ...
    (alt.cellular.cingular)
  • [EXPL] Maelstrom Vulnerable to a Local Buffer Overflow (Another Exploit)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... housewarming rates on automated network vulnerability ... to a Local Buffer Overflow, there is a buffer overflow vulnerability in ... Maelstrom which allow local attacker arbitrary code execution. ...
    (Securiteam)