Twenty Year Anniversary

HID ActivID ActivClient 7.1.0.202 Heap Spray / Denial Of Service

HID ActivID ActivClient 7.1.0.202 Heap Spray / Denial Of Service
Posted Oct 27, 2018
Authored by Harrison Neal

HID ActivID ActivClient version 7.1.0.202 may not enforce upper bounds on the size of data received from a smart card, which can lead to attacks such as memory exhaustion, or serve as a heap spraying primitive for other attacks against the software, albeit slowly.

tags | exploit, denial of service
MD5 | a29f7cb371429ae6f35c995442f6104d

HID ActivID ActivClient 7.1.0.202 Heap Spray / Denial Of Service

Change Mirror Download
HID ActivID ActivClient 7.1.0.202 may not enforce upper bounds on the size
of
data received from a smart card, which can lead to attacks such as memory
exhaustion, or serve as a heap spraying primitive for other attacks against
the
software, albeit slowly.

For example, when running Advanced Diagnostics with an "Oberthur ID-One PIV"
smart card, part of the back and forth can look like the following:



> CLA=00 INS=cb P1=3f P2=ff Lc=05 [5 data bytes] Le=00
< [the first 256 byte block of metadata and an X.509 certificate]
< SW1=61 SW2=00

[the following request and response repeats as much as necessary]

> CLA=00 INS=c0 P1=00 P2=00 Le=00
< [the next 256 byte block]
< SW1=61 SW2=00

[the prior request and response repeats as much as necessary]

> CLA=00 INS=c0 P1=00 P2=00 Le=00
< [the second to last block]
< SW1=61 SW2=[number of remaining bytes in last block]

> CLA=00 INS=c0 P1=00 P2=00 Le=[number of remaining bytes in last block]
< [remaining bytes]
< SW1=90 SW2=00



So long as a malicious card responds with SW1=61 and SW2=00, the loop above
appears to continue indefinitely, with the software being unresponsive to
the
"Cancel" button and continuously consuming additional memory. This was
tested
for several hours on a Windows 10 workstation with an Omnikey 3021 smart
card
reader.

HID may wish to have their software break the above loop (and those like it)
after an excessive number of blocks have been received.


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    1 Files
  • 3
    Dec 3rd
    18 Files
  • 4
    Dec 4th
    40 Files
  • 5
    Dec 5th
    16 Files
  • 6
    Dec 6th
    50 Files
  • 7
    Dec 7th
    12 Files
  • 8
    Dec 8th
    1 Files
  • 9
    Dec 9th
    1 Files
  • 10
    Dec 10th
    15 Files
  • 11
    Dec 11th
    30 Files
  • 12
    Dec 12th
    25 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close