Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:16304
HistoryMar 10, 2007 - 12:00 a.m.

Pre-open files attack agains locked file

2007-03-1000:00:00
vulners.com
50

Hello lists, hello Roger. It's me again.

Sorry for annoyance, but there is one more attack vector with pre-open
files I meant, but forgot to mention. It seems dangerous enough and need
to be investigated for different applications. Attack is against
application relying on mandatory locks.

Attack scenario:

  1. Alice pre-opens some Document and awaits Bob to open it. Document is
    safe to open (text file, video file, business application format, etc).
    Also, like in case of Microsoft Word it can be temporary file.
  2. Bob opens Document with some Application.
  3. Application locks file and reads or writes some data
  4. Alice modifies data
  5. Application reads previously accessed data. Because application
    relies on the fact data can not be modified in locked file, this data is
    not validated. It can lead to the problems like buffer overflows and to
    ability to modify execution flow and to arbitrary code execution.

What can be instead of Application? Any application to process user
supplied file which locks this file during processing.

Examples are: Microsoft Office applications, video/audio players, etc. I
expect huge number of applications are vulnerable and will be grateful
to everyone who can help me to find this kind of vulnerabilities
in-the-wild, because this kind of vulnerability is not trivial and hard
to catch without source code analysis.


http://securityvulns.com/
/\_/\
{ , . } |\
±-oQQo->{ ^ }<-----+ \
| ZARAZA U 3APA3A } You know my name - look up my number (The Beatles)
±------------o66o–+ /
|/