exploit the possibilities

HID ActivID ActivClient 7.1.0.202 Heap Spray / Denial Of Service

HID ActivID ActivClient 7.1.0.202 Heap Spray / Denial Of Service
Posted Oct 27, 2018
Authored by Harrison Neal

HID ActivID ActivClient version 7.1.0.202 may not enforce upper bounds on the size of data received from a smart card, which can lead to attacks such as memory exhaustion, or serve as a heap spraying primitive for other attacks against the software, albeit slowly.

tags | exploit, denial of service
MD5 | a29f7cb371429ae6f35c995442f6104d

HID ActivID ActivClient 7.1.0.202 Heap Spray / Denial Of Service

Change Mirror Download
HID ActivID ActivClient 7.1.0.202 may not enforce upper bounds on the size
of
data received from a smart card, which can lead to attacks such as memory
exhaustion, or serve as a heap spraying primitive for other attacks against
the
software, albeit slowly.

For example, when running Advanced Diagnostics with an "Oberthur ID-One PIV"
smart card, part of the back and forth can look like the following:



> CLA=00 INS=cb P1=3f P2=ff Lc=05 [5 data bytes] Le=00
< [the first 256 byte block of metadata and an X.509 certificate]
< SW1=61 SW2=00

[the following request and response repeats as much as necessary]

> CLA=00 INS=c0 P1=00 P2=00 Le=00
< [the next 256 byte block]
< SW1=61 SW2=00

[the prior request and response repeats as much as necessary]

> CLA=00 INS=c0 P1=00 P2=00 Le=00
< [the second to last block]
< SW1=61 SW2=[number of remaining bytes in last block]

> CLA=00 INS=c0 P1=00 P2=00 Le=[number of remaining bytes in last block]
< [remaining bytes]
< SW1=90 SW2=00



So long as a malicious card responds with SW1=61 and SW2=00, the loop above
appears to continue indefinitely, with the software being unresponsive to
the
"Cancel" button and continuously consuming additional memory. This was
tested
for several hours on a Windows 10 workstation with an Omnikey 3021 smart
card
reader.

HID may wish to have their software break the above loop (and those like it)
after an excessive number of blocks have been received.


Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    12 Files
  • 4
    Jul 4th
    1 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    25 Files
  • 7
    Jul 7th
    35 Files
  • 8
    Jul 8th
    4 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close