[NEWS] DOSBox Filesystem Access

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

DOSBox Filesystem Access
------------------------------------------------------------------------

SUMMARY

<http://dosbox.sourceforge.net> DOSBox is an excellent emulator for
running software written for the DOS environment like programs and games
(moreover abandonware games which are very used today). It's possible to
access files outside the environment created by the virtual machine.

DETAILS

Vulnerable Systems:
* DOSBox version 0.72

DOSBox acts as a virtual machine in which the filesystem is limited to the
folders that the user decides to mount as virtual drives and any
instruction is emulated within DOSBox without accessing the external
resources and memory. So practically the emulated DOS program can work
only inside this "cage" (that's also why is possible to run viruses and
malware without problems for the system).

Anyway although these limitations exists a very simple way to gain access
to the entire real filesystem (so not only the virtual one) because the
MOUNT command used by DOSBox for mounting the real folders as virtual
drives can be called just by the same emulated program.

In short if the program executes system("mount x c:\"); it gains
read/write access to the C: disk where is then possible to modify all the
files on which the user has access (like for example placing the execution
of a program at the next reboot or substituting a valid executable with a
custom one).

MOUNT is not the only DOSBox related command available (check the Z: disk)
but is the only one which has a real security impact if executed.

POC:
<http://aluigi.org/poc/dosboxxx.zip> http://aluigi.org/poc/dosboxxx.zip

Fix:
The developers don't think this can be considered a security problem.

ADDITIONAL INFORMATION

The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
The original article can be found at:
<http://aluigi.altervista.org/adv/dosboxxx-adv.txt>

http://aluigi.altervista.org/adv/dosboxxx-adv.txt

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.