Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Code to Trigger MS14-066 ECDSA Server BOF Vulnerability

Summary: Microsoft released a patch for a critical heap buffer overflow in Secure Channel (Schannel) tracked as MS14-066, and BeyondTrust published a method for triggering it by using OpenSSL s_client to authenticate to an IIS server and patching s3_cInt.c to fuzz the code path until a crash occurred in memcpy. Unit 42 researchers then patched the OpenSSL 1.0.1 source to build a demonstration program, showing that the rlen and slen values control the size passed to two vulnerable memcpy calls in the schannel function iCM_DecodeSigAndReverse, producing a heap overflow and a 0xc0000005 access violation.

Key Takeaway: A remote user can control the size passed into those memcpy calls, meaning an unpatched IIS server can be crashed or driven toward exploitation over the network by anyone who can reach it. Palo Alto Networks issued signatures 37057-37061 for this, so the question is whether your IIS estate was patched before someone else's copy of this demonstration code reached it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related