Penetration Testing mailing list archives
RE: C# Exceptions
From: "Patrick" <patrick () curioustechnology com>
Date: Sat, 26 Aug 2006 02:29:37 -0700
Hi 3school, First of all, they're exceptions, not acceptions ;). The errors you're looking at need to be taken in context, so as a casual reader, I don't have enough information to determine whether or not your errors may lead to an exploitable condition. Your goal should be to trigger a path of code execution that should not normally be possible if valid data is provided to the application. Because it's a .net application, you're not likely to be able to find a buffer overflow condition. There is an exception to this rule (and this is a small sampling of all possible .net scenarios) in that C# supports the [unsafe] keyword. It is theoretically possible to create a c# application that is vulnerable to the traditional stack smashing attacks, but I wouldn't hold my breath in the instance of your app. The first 3 errors you've referenced on their own look like simple exceptions. They are common in instances when a developer has implemented proper exception handling as well in instances when a dev has not. The access violation exception looks to me like the application properly rejects an attempt to write to an acl'd location (the hard disk or to the registry, for example) when the app doesn't have permission to do so. Probably not a lot to pursue there, but each application is unique. The null reference exception occurs when an object is referenced that hasn't been appropriately instantiated using the 'new' keyword. This would reflect a bad coding technique- perhaps the object is instantiated elsewhere outside of a while loop or in a different if/then branch. It might be interesting to pursue. The Invalid Object exception can happen anywhere. Some odd boxing might be happening and the object is getting passed to function that expects a different type of object. Again, reflects bad coding- the dev failed to anticipate this condition. It might bbe interesting. The Application Crash Dump is not really an error- it's the memory dump at the point of failed code execution... If it were a non-.net application, this might be an interesting piece of data for stack smashing, but not useful in .net. IF you have the symbols, you may be able to reconstruct what's going on at the stack (what memory values are where, what function calls are being made, etc). However, .net has demonstrated great resilience to shellcode type attacks. You're really going to be looking at a difficult challenge in manipulating the ways an app writes data to disk if you're looking to gain access to the machine. D.o.S. is a different matter, however. - HTH, -P -----Original Message----- From: 3 shool [mailto:3shool () gmail com] Sent: Thursday, August 24, 2006 11:59 PM To: pen-test () securityfocus com Subject: C# Exceptions Hi, I'm testing a C# desktop application. During my testing so far we have found security issues that lead to application crash with following type of errors: 1. Acess Violation Acception 2. Null Reference Acception 3. Invalid Object Acception 4. Application crash dump Are these issues really a security threat for a desktop application? We got these errors by sending junk data over the network replies that this application gets from its web services. However I fail to understand the security implication and risk of these exceptions. Since this is a desktop application and not a web service or server how would these issues impact the security of the desktop application. The application doesn't open any port on the network for incoming requests. What would be the best strategy to test such application? What would be the points from where attacker could attack such a aplication. I'll really appreciate some enlightening thoughts on above queries. Thanx in advance. ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------ ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------
Current thread:
- C# Exceptions 3 shool (Aug 25)
- Message not available
- Re: C# Exceptions 3 shool (Aug 25)
- Message not available
- Re: C# Exceptions 3 shool (Aug 25)
- Re: C# Exceptions 3 shool (Aug 25)
- Message not available
- Message not available
- Re: C# Exceptions 3 shool (Aug 25)
- RE: C# Exceptions Patrick (Aug 26)
- Re: C# Exceptions 3 shool (Aug 27)
- RE: C# Exceptions Patrick (Aug 27)
- Re: C# Exceptions 3 shool (Aug 27)
- <Possible follow-ups>
- RE: C# Exceptions Krpata, Tyler (Aug 25)
- Re: C# Exceptions 3 shool (Aug 25)
- Re: C# Exceptions 3 shool (Aug 25)
- RE: C# Exceptions Steven Scheffler (Aug 28)
- RE: C# Exceptions Patrick (Aug 28)
- Re: C# Exceptions 3 shool (Aug 28)
- Re: C# Exceptions 3 shool (Aug 31)