[NT] Cisco Call Manager CTLProvider Heap Overflow Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Cisco Call Manager CTLProvider Heap Overflow Vulnerability
------------------------------------------------------------------------

SUMMARY

A vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Cisco CallManager. Authentication is not
required to exploit this vulnerability.

DETAILS

Vulnerable Systems:
* Cisco Call Manager version 4.1(3)

The specific flaw exists within the CTL Provider Service, CTLProvider.exe,
which binds to TCP port 2444. The service operates over a SSL encrypted
transport. Due to a logic flaw in the way data is received in a loop a
heap allocation can be arbitrarily overflown resulting in the control of
subsequent heap chunks. This can lead to arbitrary code execution.

The vulnerability is due to a loop that occurs during receive of socket
data. An initial buffer is allocated at 0x19000 bytes, as can bee seen
here.

text:00406077 191A8 68+ push 19000h ; size_t
text:0040607C 191AC FF+ call ds:__imp_malloc
text:00406082 191AC 83+ add esp, 10h
text:00406085 1919C 89+ mov [edi+14h], eax
text:00406088 1919C 85+ test eax, eax
text:0040608A 1919C 0F+ jz loc_406238

Once allocated data is read in 0x19000 chunks. If more than 0x4000 bytes
of data are left on the socket we loop again as can be seen here.

text:004060A5 191AC FF+ push dword ptr [ebp-14h] ; size_t
text:004060A8 191B0 8D+ lea eax, [ebp-1919Ch]
text:004060AE 191B0 50 push eax ; void *
text:004060AF 191B4 8B+ mov eax, [edi+14h]
text:004060B2 191B4 03+ add eax, [ebp-1Ch]
text:004060B5 191B4 50 push eax ; void *
text:004060B6 191B8 E8+ call memcpy
text:004060B6 191B8 2F+
text:004060BB 191B8 B8+ mov eax, 16384
text:004060C0 191B8 83+ add esp, 1Ch
text:004060C3 1919C 39+ cmp [ebp-14h], eax
text:004060C6 1919C 75+ jnz short loc_4060F8

text:004060C8 1919C 50 push eax ; int
text:004060C9 191A0 68+ push offset str__ErrDExceeds16k ; 'err %d
exceeds 16K'
text:004060CE 191A4 8D+ lea eax, [ebp-88h]
text:004060D4 191A4 68+ push 80000h ; int
text:004060D9 191A8 50 push eax ; int
text:004060DA 191AC E8+ call log_message
text:004060DA 191AC B7+
text:004060DF 191AC 83+ add esp, 10h
text:004060E2 1919C 81+ add dword ptr [ebp-1Ch], 4000h
text:004060E9 1919C 68+ push offset
str__MaybeThereIsMoreData__readAgain ; "Maybe there is more data..Read
again"
text:004060EE 191A0 68+ push 10000h
text:004060F3 191A4 E9+ jmp loc_405FFF

This will continue until heap chunks are overwritten at the users control,
which can be exploited to overwrite memory and further lead to arbitrary
code execution.

Vendor Response:
<http://www.cisco.com/warp/public/707/cisco-sa-20080116-cucmctl.shtml>

http://www.cisco.com/warp/public/707/cisco-sa-20080116-cucmctl.shtml

Disclosure Timeline:
2007.06.04 - Vulnerability reported to vendor
2008.01.16 - Coordinated public release of advisory

ADDITIONAL INFORMATION

The information has been provided by <mailto:dvlabs@tippingpoint.com>
DVLabs.
The original article can be found at:
<http://dvlabs.tippingpoint.com/advisory/TPTI-08-02>

http://dvlabs.tippingpoint.com/advisory/TPTI-08-02

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.