arnold
22-07-05, 16:15
VERITAS NETBACKUP 5.1 'TIME_STAMP' VULNERABILITY
Date: 07/2005
Risk: Low/Medium
Soft: VERITAS
OS : All supported win32
I. VULNERABILITY
NETBACKUP as his brother BEXEC runs a NDMP server to 10000/TCP. This same service is calling another executable
when doing some particular requests. This is possible to produce an access violation with the help of
this last executable while sending a 'CONFIG' message request to the NDMP server with a timestamp in the ndmpheader out of range.
enum ndmp_message_type
{
NDMP_REQUEST
};
struct ndmp_header
{
u_long sequence; (local counter that starts at 1 and increases by 1 for every message sent)
u_long time_stamp; (in seconds since 00:00:00 GMT, Jan 1, 1970)
ndmp_message_type message_type; (request or reply message)
ndmp_message message; (tape data config etc)
u_long reply_sequence; (number from the request message to which the reply is associated)
ndmp_error error; (verbose)
};
II. PROOF OF CONCEPT
Not published, probably soon on a forum nor mailing list, else when you know of the ndmp protocol, this is not that
hard to trigger it by yourself.
III. RISK
Does not looks that big at a first look but my 10$ to this that it doens't smell good unreadable datas at 0x00000000, I have maybe missed up
a field to overwrite during my tests letting us to force the executable to read malicious code, if yes, this might be critical, because the main service
does not crash, allowing multiple hacking attempts.
IV. DISCOVERY
HAT-SQUAD.com
V. GREETINGS
Nima,Behrang,strcpy
To SuperList [at] class101.org :D
To the spammer SPIKEr tom ferris ;-)))))
Date: 07/2005
Risk: Low/Medium
Soft: VERITAS
OS : All supported win32
I. VULNERABILITY
NETBACKUP as his brother BEXEC runs a NDMP server to 10000/TCP. This same service is calling another executable
when doing some particular requests. This is possible to produce an access violation with the help of
this last executable while sending a 'CONFIG' message request to the NDMP server with a timestamp in the ndmpheader out of range.
enum ndmp_message_type
{
NDMP_REQUEST
};
struct ndmp_header
{
u_long sequence; (local counter that starts at 1 and increases by 1 for every message sent)
u_long time_stamp; (in seconds since 00:00:00 GMT, Jan 1, 1970)
ndmp_message_type message_type; (request or reply message)
ndmp_message message; (tape data config etc)
u_long reply_sequence; (number from the request message to which the reply is associated)
ndmp_error error; (verbose)
};
II. PROOF OF CONCEPT
Not published, probably soon on a forum nor mailing list, else when you know of the ndmp protocol, this is not that
hard to trigger it by yourself.
III. RISK
Does not looks that big at a first look but my 10$ to this that it doens't smell good unreadable datas at 0x00000000, I have maybe missed up
a field to overwrite during my tests letting us to force the executable to read malicious code, if yes, this might be critical, because the main service
does not crash, allowing multiple hacking attempts.
IV. DISCOVERY
HAT-SQUAD.com
V. GREETINGS
Nima,Behrang,strcpy
To SuperList [at] class101.org :D
To the spammer SPIKEr tom ferris ;-)))))