Unbreakable Lotus Notes

Hello all,

Rapid7 reported a buffer overflow in Lotus Notes Protocol Authentication just a couple of months ago
(http://www.rapid7.com/advisories/R7-0010-info.html). Lotus claims that "this program has not been demonstrated to result in execution of malicious code".

Unconvinced, I tried messing around with it and managed to crash Lotus Notes Server by following Rapid7's advisory. All seems right, only a few details in the advisory were incorrect:

1. "If the length specified in the outer header field is less than or equal to the length specified in the DN field, an error occurs in the data offset arithmetic such that a total of 65534 bytes are copied onto the Notes heap.."

Outer header field must be less than the length specified in the DN field in order for the byte counter to be reset to 0xFFFE. It is also possible to copy more than 65534 bytes onto the Notes heap, by crafting the packet such that the counter resets to 0xFFFE each time it reaches ->2 where it breaks out.

2) "An attacker can supply all of the bytes to be copied by specifying additional data in the packet after the DN".

While it is possible to control N in copying N*65534 bytes, it is not possible to supply all of the bytes. Each authentication request contains a length field in the header, such that, data limited by this length is first truncated before it is processed. The value of this length field is capped at 0x1f40 bytes, sending any one byte more will cause the session to be disconnected immediately. This essentially prevents anyone from supply all of the N*65534 bytes to be copied onto the heap.

With these limitations, EBX and EDX were nevertheless overwritten in OSFreeDBlockWithSize() and
could have been used to overwrite something useful onto the return EIP or some function pointers
only to meet into a number of problems - 1) The proprietory heap does not implement a back pointer or anything useful to be overwritten into the return EIP or a function pointer in OSFreeDBlockWithSize(); 2) It is not possible to craft EBX/EDX such that the chunk headers (or anywhere else) are overwritten with anything useful.

Lotus is probably right, Notes Server is unbreakable.

--
A1otta Black

_________________________________________________________________
Stay in touch with absent friends - get MSN Messenger 
http://www.msn.co.uk/messenger

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek