A remotely exploitable vulnerability has been found in the HTTP header parsing code of the CFNetwork framework.
3cd844ab4b16ffea30d4bf56950667b6ccf6b6b2a12354c933cb59ebebbbebe9
n.runs AG
http://www.nruns.com/ security(at)nruns.com
n.runs-SA-2009.001 15-May-2009
________________________________________________________________________
Vendor: Apple Inc., http://www.apple.com
Affected Products: Mac OS X 10.5.6
Vulnerability: Heap-based buffer overflow in CFNetwork component
(remote)
Risk: HIGH
________________________________________________________________________
Vendor communication:
2009/04/17 Initial notification of Apple including n.runs RFP
2009/04/27 Received response from Apple about planned disclosure date
2009/04/29 Received update from Apple about adjusted disclosure date
2009/05/12 Apple issues updates
________________________________________________________________________
Overview:
CFNetwork is a framework in the Core Services framework that provides a
library of abstractions for network protocols. It can be used to perform
a variety of network tasks using different protocols such as SSL/TLS,
DNS, FTP and HTTP.
Besides many other applications the CFNetwork framework is used by
Safari and Mail.
Description:
A remotely exploitable vulnerability has been found in the HTTP header
parsing code. Each HTTP header received from a web server is first
capitalized. I.e. the first character of the header name is upper-cased
while all remaining characters are lower-cased. Inside the CFNetwork
framework the _CFCapitalizeHeader() function is used for this purpose.
The first thing this function does is to convert the header name into
UTF-16 encoded form. Depending on the length of the header name the
result is either stored in a local stack buffer or in a buffer
allocated on the heap. For all header names > 511 bytes a heap buffer
is allocated as follows:
__text:00003A35 loc_3A35:
__text:00003A35 mov esi, [ebp+var_810]
__text:00003A3B add esi, esi
__text:00003A3D mov [esp+838h+var_838], esi
__text:00003A40 call _malloc
At address 0x00003A35 the length of the header name is stored in %esi
and then doubled to hold the UTF-16 encoded variant. After the buffer
was allocated some variables are setup. At 0x00003A4D the destination
pointer for the following memory copy operation is stored.
__text:00003A45 add esi, eax
__text:00003A47 mov [ebp+var_81C], eax
__text:00003A4D mov [ebp+var_814], esi
__text:00003A53 mov [ebp+var_818], eax
Note that in contrary to the stack buffer, where a pointer to the
_start_ of the buffer is stored in [ebp+var_814], this code stores
a pointer to the _end_ of the allocated buffer. The following
memory copy loop starting at 0x00003AD1 then stores the UTF-16
encoded header name not inside the buffer, but directly after it
which leads to an exploitable heap-based buffer overflow.
Impact:
One attack vector is the Safari browser. An attacker can exploit
this vulnerability by providing his own web server. When a user
visits the provided site, the vulnerability allows remote code
execution.
Solution:
Apple has issued an update to correct this vulnerability. More details
can be found at: http://support.apple.com/kb/HT1222
________________________________________________________________________
Credit:
Bug found by Moritz Jodeit of n.runs AG.
________________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0157
This Advisory and Upcoming Advisories:
http://www.nruns.com/security_advisory.php
________________________________________________________________________
Unaltered electronic reproduction of this advisory is permitted. For all
other reproduction or publication, in printing or otherwise, contact
security@nruns.com for permission. Use of the advisory constitutes
acceptance for use in an "as is" condition. All warranties are excluded. In
no event shall n.runs be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages, even if n.runs has been advised of the possibility of such damages.
Copyright 2009 n.runs AG. All rights reserved. Terms of use apply.