Re: iDefense Security Advisory 07.09.07: WinPcap NPF.SYS Local Privilege Escalation Vulnerability

["KJK::Hyperion" <hackbunny () s0ftpj org>]

iDefense Labs wrote:
> WinPcap NPF.SYS Local Privilege Escalation Vulnerability
>
> iDefense Security Advisory 07.09.07
> http://labs.idefense.com/intelligence/vulnerabilities/
> Jul 09, 2007
>
> I. BACKGROUND
>
> WinPcap is a software package that facilitates real-time link-level
> network access for Windows-based operating systems. It is used by a
> wide range of open-source projects including Wireshark. More
> information is available at the project web site at the URL shown
> below.
>
> http://www.winpcap.org/
>
> II. DESCRIPTION
>
> Local exploitation of an input validation vulnerability within the
> NPF.SYS device driver of WinPcap allows attackers to execute arbitrary
> code in kernel context.
>
> The vulnerability specifically exists due to insufficient input
> validation when handling the Interrupt Request Packet (Irp) parameters
> passed to IOCTL 9031 (BIOCGSTATS). By passing carefully chosen
> parameters to this IOCTL, an attacker can overwrite arbitrary kernel
> memory.
>
> III. ANALYSIS
>
> Exploitation allows attackers to execute arbitrary code in kernel
> context.
>
> The vulnerable device driver is loaded when WinPcap is initialized. This
> driver can be set to load on start-up depending on a choice made at
> installation time. This is not the default setting.
>
> In a default installation, the device driver is not loaded until an
> Administrator utilizes a WinPcap dependent application. Once they do,
> it will become accessible to normal users as well. When a program using
> this driver exists, it is not unloaded. Attackers will continue to have
> access until the driver is manually unloaded.
Nobody seemed to care about my patch for custom security on the capture 
device:

<http://www.winpcap.org/pipermail/winpcap-bugs/2005-June/000029.html>

In other news, Microsoft just released Network Monitor 3.1:

<http://www.microsoft.com/downloads/details.aspx?familyid=18b1d59d-f4d8-4213-8d17-2f6dde7d7aac>

(I'm extremely impressed by the improvements on 2.x, BTW)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/