Jump to content

Cisco ASA WebVPN CIFS Handling Buffer Overflows

Recommended Posts

Cisco ASA: Buffer overflows in WebVPN cifs handling


The WebVPN http server exposes a way of accessing files from CIFS with a url hook of the form: <a href="https://portal/+webvpn+/CIFS_R/share_server/share_name/file" title="" class="" rel="nofollow">https://portal/+webvpn+/CIFS_R/share_server/share_name/file</a>.

When someone logged into the portal navigates to such an address, the http_cifs_process_path function parses the request URI and creates 2 C strings in a http_cifs_context struct:

+0x160 char* file_dir
+0x168 char* file_name

These strings are copied in various places, but is done incorrectly. For example, in ewaURLHookCifs, there is the following pseudocode:

filename_copy_buf = calloc(1LL, 336LL);
net_handle[10] = filename_copy_buf;
if ( filename_copy_buf )
src_len = _wrap_strlen(filename_from_request);
if ( filename_from_request[src_len - 1] == ('|') )
// wrong length (src length)
strncpy((char *)filename_copy_buf, filename_from_request,
src_len - 1);

In this case, a fixed size buf (|filename_copy_buf|) is allocated. Later, strncpy is called to copy to it, but the length passed is the length of the src string, which can be larger than 366 bytes. This leads to heap overflow.

There appear to be various other places where the copying is done in an unsafe way:

http_cifs_context_to_name, which is called from ewaFile{Read,Write,Get}Cifs, and ewaFilePost, uses strcat to copy the file path and file name to a fixed size (stack) buffer.

http_cifs_pre_fopen, which has a similar issue with passing the length of the src buffer to strncpy.

Possibly http_add_query_str_from_context. There are probably others that I missed.

Note that triggering this bug requires logging in to the WebVPN portal first, but the cifs share does not need to exist.


Login to WebVPN portal, navigate to:

<a href="https://portal/+webvpn+/CIFS_R/server/name/" title="" class="" rel="nofollow">https://portal/+webvpn+/CIFS_R/server/name/</a> followed by 500 'A's.

("server" and "name" may be passed verbatim)

*** Error in `lina': malloc(): memory corruption: 0x00007fa40c53f570 ***
======= Backtrace: =========

This was tested on 9.6(2)

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...