端對(duì)端數(shù)據(jù)傳輸時(shí)，用于迅速通告對(duì)方本端發(fā)生的重要事件。帶外數(shù)據(jù)比普通數(shù)據(jù)（也稱帶內(nèi)數(shù)據(jù)）有更高的優(yōu)先級(jí)，總是立即發(fā)送，而不論發(fā)送緩沖區(qū)是否有排隊(duì)等待發(fā)送的普通數(shù)據(jù)。 帶外數(shù)據(jù)的傳輸可以使用一條獨(dú)立的傳輸層連接，也可以映射到傳輸普通數(shù)據(jù)的連接中，即帶外數(shù)據(jù)并不是通過兩條套接字連接來實(shí)現(xiàn)的，這類數(shù)據(jù)也是通過已有的連接來傳輸。
Talos公司此次發(fā)現(xiàn)一項(xiàng)可被利用的緩沖區(qū)溢出漏洞，利用特定OFX文件，其可能出現(xiàn)寫入操作邊界溢出，并導(dǎo)致對(duì)方獲得代碼執(zhí)行能力：
TALOS-2017-0317 (CVE-2017-2816) - LibOFX標(biāo)簽解析代碼執(zhí)行漏洞
此項(xiàng)漏泄目前尚未得到修復(fù)，而Talos方面在《供應(yīng)商漏洞報(bào)告與披露政策》指定的期限之內(nèi)亦未收到相關(guān)開發(fā)人員給出的回復(fù)。
諷刺的是，該漏洞位于清理功能當(dāng)中的標(biāo)簽解析流程內(nèi)。在此功能當(dāng)中，標(biāo)簽名稱會(huì)以本地方式存儲(chǔ)在堆棧之內(nèi)，而過長的標(biāo)簽名稱則會(huì)造成堆棧溢出。
CVE-2017-2816漏洞詳情OFX是一個(gè)開放性財(cái)務(wù)數(shù)據(jù)交換協(xié)議，金融機(jī)構(gòu)使用OFX與客戶共享財(cái)務(wù)數(shù)據(jù)。
LibOFX是開放性金融交易（OFX）的開源解析庫，金融機(jī)構(gòu)使用OFX與客戶共享金融數(shù)據(jù)。作為一套復(fù)雜的標(biāo)準(zhǔn)實(shí)現(xiàn)方案，這套庫被GnuCash等財(cái)務(wù)軟件所廣泛使用。GnuCash能使用OFX的開源解析庫libOFX導(dǎo)入OFX記錄。
解析給定OFX記錄的標(biāo)簽時(shí)， libOFX嘗試去掉現(xiàn)有OFX的專有標(biāo)簽。
檢查正確OFX標(biāo)簽
【代碼】
lib/ofx_preproc.cpp:75
const unsigned int READ_BUFFER_SIZE = 1024;
lib/ofx_preproc.cpp:417
string sanitize_proprietary_tags(string input_string)
{
unsigned int i;
size_t input_string_size;
bool strip = false;
bool tag_open = false;
int tag_open_idx = 0; //Are we within < > ?
bool closing_tag_open = false; //Are we within ?
int orig_tag_open_idx = 0;
bool proprietary_tag = false; //Are we within a proprietary element?
bool proprietary_closing_tag = false;
int crop_end_idx = 0;
char buffer[READ_BUFFER_SIZE] = "";
char tagname[READ_BUFFER_SIZE] = "";
int tagname_idx = 0;
char close_tagname[READ_BUFFER_SIZE] = "";
for (i = 0; i < input_string_size; i++)
if (input_string.c_str()[i] == '<')
{
tag_open = true;
tag_open_idx = i;
if (proprietary_tag == true && input_string.c_str()[i+1] == '/')
{
...
}
else if (proprietary_tag == true)
{
//It is the start of a new tag, following a proprietary tag
crop_end_idx = i - 1;
strip = true;
}
}
else if (input_string.c_str()[i] == '>')
{
...
}
else if (tag_open == true && closing_tag_open == false)
{
if (input_string.c_str()[i] == '.')
{
if (proprietary_tag != true)
{
orig_tag_open_idx = tag_open_idx;
proprietary_tag = true;
}
}
tagname[tagname_idx] = input_string.c_str()[i]; [0]
tagname_idx++;
由于input_string變量會(huì)造成循環(huán)，如果input_string大于READ_BUFFER_SIZE，這個(gè)堆棧變量tagname就造成緩沖區(qū)溢出，并可能潛在執(zhí)行惡意代碼。
【崩潰信息】
==6542==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffbb4260 at pc 0x7fab9d30ccc1 bp 0x7fffffbb39b0 sp 0x7fffffbb39a8
WRITE of size 1 at 0x7fffffbb4260 thread T0
#0 0x7fab9d30ccc0 (/home/vagrant/fuzzing/libofx-asan/libofx-0.9.11/lib/.libs/libofx.so.7+0x30cc0)
#1 0x7fab9d30aba0 (/home/vagrant/fuzzing/libofx-asan/libofx-0.9.11/lib/.libs/libofx.so.7+0x2eba0)
#2 0x7fab9d3057cb (/home/vagrant/fuzzing/libofx-asan/libofx-0.9.11/lib/.libs/libofx.so.7+0x297cb)
#3 0x4f8ba2 (/home/vagrant/fuzzing/libofx-asan/libofx-0.9.11/ofxdump/.libs/lt-ofxdump+0x4f8ba2)
#4 0x7fab9c06982f (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#5 0x419618 (/home/vagrant/fuzzing/libofx-asan/libofx-0.9.11/ofxdump/.libs/lt-ofxdump+0x419618)
Address 0x7fffffbb4260 is located in stack of thread T0 at offset 2208 in frame
#0 0x7fab9d30c38f (/home/vagrant/fuzzing/libofx-asan/libofx-0.9.11/lib/.libs/libofx.so.7+0x3038f)
This frame has 9 object(s):
[32, 1056) 'buffer'
[1184, 2208) 'tagname' <== Memory access at offset 2208 overflows this variable
[2336, 3360) 'close_tagname'
[3488, 3520) ''
[3552, 3584) ''
[3616, 3617) ''
[3632, 3664) ''
[3696, 3728) ''
[3760, 3761) ''
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/vagrant/fuzzing/libofx-asan/libofx-
0.9.11/lib/.libs/libofx.so.7+0x30cc0)
Shadow bytes around the buggy address:
0x10007ff6e7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007ff6e800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007ff6e810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007ff6e820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007ff6e830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007ff6e840: 00 00 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2
0x10007ff6e850: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00
0x10007ff6e860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007ff6e870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007ff6e880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007ff6e890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==6542==ABORTING
欲了解更多與此項(xiàng)安全漏洞相關(guān)的細(xì)節(jié)信息，請(qǐng)參閱研究報(bào)告：TALOS-2017-0317
經(jīng)測試版本：LibOFX 0.9.11
產(chǎn)品網(wǎng)址：CVSSv3漏洞評(píng)分8.8分- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE未檢查輸入大小的緩沖區(qū)拷貝（傳統(tǒng)的緩沖區(qū)溢出）
時(shí)間線：2017-04-14 - 廠商披露
2017-09-13 – 公開發(fā)布
漏洞影響作為一套開源庫，LibOFX適用于多種財(cái)務(wù)應(yīng)用程序。此項(xiàng)漏洞的存在意味著攻擊者將能夠借此實(shí)現(xiàn)多種操作。觸發(fā)此項(xiàng)漏泄并不需要特定的用戶交互活動(dòng)，且任何受此漏洞影響的系統(tǒng)皆有可能包含具有重要價(jià)值的財(cái)務(wù)信息——此類信息可能被用于實(shí)施身份盜用、欺詐或者被轉(zhuǎn)售給其他犯罪分子。
各類企業(yè)機(jī)構(gòu)可能尚未意識(shí)到這套庫存在于第三方軟件內(nèi)被用于解析OFX文件，或者被納入內(nèi)部項(xiàng)目中的某些軟件。大家應(yīng)當(dāng)持續(xù)關(guān)注內(nèi)部項(xiàng)目中所使用的開源庫方案，并快速應(yīng)用由第三方供應(yīng)商提供的修復(fù)補(bǔ)丁，從而確保此類安全漏洞在被攻擊者實(shí)際利用之前得到正確管理。
以下Snort規(guī)則將檢查對(duì)該漏洞的利用活動(dòng)：
Snort規(guī)則: 42277-4227
請(qǐng)注意：未來可能將陸續(xù)發(fā)布更多后續(xù)規(guī)則，且目前的規(guī)則亦可能在更多漏洞信息曝光后發(fā)生變更。欲了解與最新規(guī)則相關(guān)的信息，請(qǐng)參閱您的FireSIGHT管理中心或者Snort.org網(wǎng)站。
京公網(wǎng)安備 11010502049343號(hào)