Full Disclosure mailing list archives
CVE-2013-4099 - JOAL 2.0-rc11 - Multiple Remote Code Execution Vulnerabilities
From: FuzzMyApp Disclosure <disclosure () fuzzmyapp com>
Date: Wed, 21 Aug 2013 18:59:05 +0200
0. Introduction Vendor description: The JOAL Project hosts a reference implementation of the Java bindings for OpenAL API, and is designed to provide hardware-supported 3D specialized audio for games written in Java. 1. Affected software JOAL 2.0-rc11 2. Vulnerability FuzzMyApp team have identified several bugs in OpenAL32.dll, which can lead to code execution. OpenAL32.dll is distributed in signed jar files. It allows to create malicious applet. If user had not used any of JogAmp's libraries before, one needs to accept installation. If user has a Sven Gothel certificate among Java trusted certificates (i.e. used JogAmp before), no interaction is needed. Vulnerable methods: 01. jogamp.openal.ALImpl.dispatch.alAuxiliaryEffectSlotf1(IIFJ)V 02. jogamp.openal.ALImpl.dispatch.alBuffer3f1(IIFFFJ)V 03. jogamp.openal.ALImpl.dispatch.alBufferfv1(IILjava/lang/Object;IZJ)V 04. jogamp.openal.ALImpl.dispatch.alDeleteEffects1(ILjava/lang/Object;IZJ)V 05. jogamp.openal.ALImpl.dispatch.alEffectf1(IIFJ)V 06. jogamp.openal.ALImpl.dispatch.alEffectfv1(IILjava/lang/Object;IZJ)V 07. jogamp.openal.ALImpl.dispatch.alEffectiv1(IILjava/lang/Object;IZJ)V 08. jogamp.openal.ALImpl.dispatch.alEnable1(IJ)V 09. jogamp.openal.ALImpl.dispatch.alFilterfv1(IILjava/lang/Object;IZJ)V 10. jogamp.openal.ALImpl.dispatch.alFilteriv1(IILjava/lang/Object;IZJ)V 11. jogamp.openal.ALImpl.dispatch.alGenAuxiliaryEffectSlots1(ILjava/lang/Object;IZJ)V 12. jogamp.openal.ALImpl.dispatch.alGenEffects1(ILjava/lang/Object;IZJ)V 13. jogamp.openal.ALImpl.dispatch.alGenFilters1(ILjava/lang/Object;IZJ)V 14. jogamp.openal.ALImpl.dispatch.alGenSources1(ILjava/lang/Object;IZJ)V 15. jogamp.openal.ALImpl.dispatch.alGetAuxiliaryEffectSlotiv1(IILjava/lang/Object;IZJ)V 16. jogamp.openal.ALImpl.dispatch.alGetBuffer3f1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V 17. jogamp.openal.ALImpl.dispatch.alGetBuffer3i1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V 18. jogamp.openal.ALImpl.dispatch.alGetBufferf1(IILjava/lang/Object;IZJ)V 19. jogamp.openal.ALImpl.dispatch.alGetBufferiv1(IILjava/lang/Object;IZJ)V 20. jogamp.openal.ALImpl.dispatch.alGetDoublev1(ILjava/lang/Object;IZJ)V 21. jogamp.openal.ALImpl.dispatch.alGetEffectf1(IILjava/lang/Object;IZJ)V 22. jogamp.openal.ALImpl.dispatch.alGetEffectfv1(IILjava/lang/Object;IZJ)V 23. jogamp.openal.ALImpl.dispatch.alGetEffectiv1(IILjava/lang/Object;IZJ)V 24. jogamp.openal.ALImpl.dispatch.alGetEnumValue1(Ljava/lang/String;J)I 25. jogamp.openal.ALImpl.dispatch.alGetFilteri1(IILjava/lang/Object;IZJ)V 26. jogamp.openal.ALImpl.dispatch.alGetFilteriv1(IILjava/lang/Object;IZJ)V 27. jogamp.openal.ALImpl.dispatch.alGetFloat1(IJ)F 28. jogamp.openal.ALImpl.dispatch.alGetFloatv1(ILjava/lang/Object;IZJ)V 29. jogamp.openal.ALImpl.dispatch.alGetListener3f1(ILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V 30. jogamp.openal.ALImpl.dispatch.alGetListener3i1(ILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V 31. jogamp.openal.ALImpl.dispatch.alGetListenerf1(ILjava/lang/Object;IZJ)V 32. jogamp.openal.ALImpl.dispatch.alGetListeneri1(ILjava/lang/Object;IZJ)V 33. jogamp.openal.ALImpl.dispatch.alGetListeneriv1(ILjava/lang/Object;IZJ)V 34. jogamp.openal.ALImpl.dispatch.alGetProcAddress1(Ljava/lang/String;J)J 35. jogamp.openal.ALImpl.dispatch.alGetProcAddressStatic(Ljava/lang/String;J)J 36. jogamp.openal.ALImpl.dispatch.alGetSource3f1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V 37. jogamp.openal.ALImpl.dispatch.alGetSource3i1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V 38. jogamp.openal.ALImpl.dispatch.alGetSourcef1(IILjava/lang/Object;IZJ)V 39. jogamp.openal.ALImpl.dispatch.alGetSourcefv1(IILjava/lang/Object;IZJ)V 40. jogamp.openal.ALImpl.dispatch.alGetSourcei1(IILjava/lang/Object;IZJ)V 41. jogamp.openal.ALImpl.dispatch.alGetSourceiv1(IILjava/lang/Object;IZJ)V 42. jogamp.openal.ALImpl.dispatch.alGetString1(IJ)Ljava/lang/String; 43. jogamp.openal.ALImpl.dispatch.alIsAuxiliaryEffectSlot1(IJ)Z 44. jogamp.openal.ALImpl.dispatch.alIsBuffer1(IJ)Z 45. jogamp.openal.ALImpl.dispatch.alIsEffect1(IJ)Z 46. jogamp.openal.ALImpl.dispatch.alIsExtensionPresent1(Ljava/lang/String;J)Z 47. jogamp.openal.ALImpl.dispatch.alIsFilter1(IJ)Z 48. jogamp.openal.ALImpl.dispatch.alListener3f1(IFFFJ)V 49. jogamp.openal.ALImpl.dispatch.alListener3i1(IIIIJ)V 50. jogamp.openal.ALImpl.dispatch.alListenerf1(IFJ)V 51. jogamp.openal.ALImpl.dispatch.alListenerfv1(ILjava/lang/Object;IZJ)V 52. jogamp.openal.ALImpl.dispatch.alListeneri1(IIJ)V 53. jogamp.openal.ALImpl.dispatch.alListeneriv1(ILjava/lang/Object;IZJ)V 54. jogamp.openal.ALImpl.dispatch.alSource3f1(IIFFFJ)V 55. jogamp.openal.ALImpl.dispatch.alSource3i1(IIIIIJ)V 56. jogamp.openal.ALImpl.dispatch.alSourcef1(IIFJ)V 57. jogamp.openal.ALImpl.dispatch.alSourcefv1(IILjava/lang/Object;IZJ)V 58. jogamp.openal.ALImpl.dispatch.alSourcei1(IIIJ)V 59. jogamp.openal.ALImpl.dispatch.alSourceiv1(IILjava/lang/Object;IZJ)V 60. jogamp.openal.ALImpl.dispatch.alSourcePause1(IJ)V 61. jogamp.openal.ALImpl.dispatch.alSourcePausev1(ILjava/lang/Object;IZJ)V 62. jogamp.openal.ALImpl.dispatch.alSourcePlay1(IJ)V 63. jogamp.openal.ALImpl.dispatch.alSourcePlayv1(ILjava/lang/Object;IZJ)V 64. jogamp.openal.ALImpl.dispatch.alSourceQueueBuffers1(IILjava/lang/Object;IZJ)V 65. jogamp.openal.ALImpl.dispatch.alSourceRewindv1(ILjava/lang/Object;IZJ)V 66. jogamp.openal.ALImpl.dispatch.alSourceStop1(IJ)V 67. jogamp.openal.ALImpl.dispatch.alSourceStopv1(ILjava/lang/Object;IZJ)V 68. jogamp.openal.ALImpl.dispatch.alSourceUnqueueBuffers1(IILjava/lang/Object;IZJ)V 69. jogamp.openal.ALImpl.dispatch.alSpeedOfSound1(FJ)V Malformed methods parameters allow full control of EIP register, which leads to remote code execution. Crash dumps are avaliable here: http://www.fuzzmyapp.com/advisories/FMA-2012-038/FMA-2012-038-EN.xml. 3. Fix JOGAMP released new version (2.0.2-rc12) fixing JOAL issues. All previous signed JAR files have been removed. Signed JAR files restricted to codebase '*.jogamp.org'. Latest JOAL implementation does not depend on buggy OpenAL library. 4. Credit FuzzMyApp Team http://www.fuzzmyapp.com/ 5. References http://www.fuzzmyapp.com/advisories/FMA-2012-038/FMA-2012-038-EN.xml http://forum.jogamp.org/Release-2-0-2-rc12-td4029471.html http://labb.zafena.se/?p=799 - FuzzMyApp _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- CVE-2013-4099 - JOAL 2.0-rc11 - Multiple Remote Code Execution Vulnerabilities FuzzMyApp Disclosure (Aug 22)