Multiple Vuln. in Hotfoon.com's Hotfoon4.exe dialer

[S G Masood <sgmasood () yahoo com>]

Multiple Vuln. in Hotfoon.com's Hotfoon4.exe dialer

Hotfoon.com is a popular provider of PC to Phone, PC
to PC Phone,Instant Messaging and Chat services. It's
services are accessed by using a client program,
Hotfoon4.exe(http://www.hotfoon.com/hotfoon4.exe),
which includes the dialer. This is claimed to be the
smallest dialer in the world(76.0 KB). But, it does
not ensure performance and security. There are
multiple vuln. in Hotfoon.com's services.
Two of them are:

(1) Plaintext Password in Registry:

 The hotfoon4.exe dialer stores the username and
password of a user in plain text in the Registry key -
"HKEY_CURRENT_USER\hotfoon2". This is pathetic. If the
password
had to be stored in the registry, a substitution
cipher could be used at the very least to atleast give
the semblance of some kind of encryption. Anybody can
navigate to this key using 'REGEDIT' and see the
password in plain text.

Once a username and password is compromised, a
malicious user can use it to make phone calls from the
legit users paid-for account.

(2) Remotely exploitable Buffer Overflow in the dial
field:

A remotely exploitable Buffer Overflow condition
exists in the 'phone number to be dialed text field'
of Hotfoon4.exe. There is no bounds check in the
field. An input of 76 bytes crashes the program and an
input of 80 bytes overwrites the ESI register.

The debugging information from a DrWatson log
file(Win2k) is given below. This may be used to write
a PoC.

eax=008b0f20 ebx=0012fe28 ecx=00000010 edx=00000000
esi=61616161 
edi=0040e900
eip=00402abb esp=0012f628 ebp=0012fe10 iopl=0        
nv up ei pl nz na 
pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000  
          
efl=00000202


function: <nosymbols>
        00402aa7 8908             mov     [eax],ecx   
          
ds:008b0f20=00830260
        00402aa9 c3               ret
        00402aaa 56               push    esi
        00402aab 8bf1             mov     esi,ecx
        00402aad 6a10             push    0x10
        00402aaf e84f4c0000       call    00407703
        00402ab4 33d2             xor     edx,edx
        00402ab6 59               pop     ecx
        00402ab7 3bc2             cmp     eax,edx
        00402ab9 7410             jz      0040b5cb
FAULT ->00402abb 8b4e04           mov    
ecx,[esi+0x4]          
ds:624b3737=????????
        00402abe 89500c           mov    
[eax+0xc],edx          
ds:0174e4f6=????????
        00402ac1 895008           mov    
[eax+0x8],edx          
ds:0174e4f6=????????
        00402ac4 8910             mov     [eax],edx   
          
ds:008b0f20=00830260
        00402ac6 894804           mov    
[eax+0x4],ecx          
ds:0174e4f6=????????
        00402ac9 eb02             jmp     00405dcd
        00402acb 33c0             xor     eax,eax
        00402acd 8b4c2408         mov    
ecx,[esp+0x8]          
ss:00fccbff=????????
        00402ad1 894808           mov    
[eax+0x8],ecx          
ds:0174e4f6=????????
        00402ad4 8b4e04           mov    
ecx,[esi+0x4]          
ds:624b3737=????????
        00402ad7 ff06             inc     dword ptr
[esi]        
ds:61616161=????????
        00402ad9 3bca             cmp     ecx,edx








This overflow is remotely exploitable. This is because
the dialer defines a URL Protocol called "Voice" and
registers itself as the handler. The URL "voice:23456"
will launch hotfoon4.exe and it will try to dial the
number "123456". Since the overflow is in the dial
field, a URL like "Voice:......<exploit string>" will
launch the program and exploit it remotely. 

For example, 
(1) Voice:aaaaaa.........76 a's
    This will crash hotfoon4.exe
(2) Voice:aaaaaa.........80 a's
    This will crash hotfoon4.exe and overwrite ESI
register.
(3) Voice:aaaaaa.....76a's...<exploit string>
    This will launch Hotfoon4.exe and exploit it.

Once the exploit is ready, a malicious just needs to
send a specially crafted URL to a user to exploit
him(download and run any program, besides other
things. This may be achieved by sending a user an HTML
mail or by making him view a web page

These two are only a few of many vuln. present in the
service. For example overflows exist in almost every
input field of the dialer but I had time to document
only the above one. Hotfoon.com is inherently buggy
and highly
insecure. 



__________________________________________________
Do you Yahoo!?
U2 on LAUNCH - Exclusive greatest hits videos
http://launch.yahoo.com/u2