Microsoft Windows CSRSS.EXE Stack Overflow Vulnerability
iDEFENSE Security Advisory 04.12.05
www.idefense.com/application/poi/display?id=230&type=vulnerabilitie s
April 12, 2005
I. BACKGROUND
The Win32 application-programming interface (API) offers a console
windows feature that provides a means to implement command-line and
other character-based user interfaces. The specific code for this
feature within the Windows 2000, XP and 2003 operating systems resides
in a core system process called CSRSS.EXE. This process is the main
executable for the Microsoft Client/Server Runtime Server Subsystem. The
process manages most graphical commands in Windows.
II. DESCRIPTION
Local exploitation of a stack-based buffer overflow vulnerability within
various versions of Microsoft Corp.'s Windows operating system allows
attackers to execute arbitrary code with SYSTEM privileges.
Console windows are created and managed by code in the WINSRV.DLL file
that resides in the CSRSS.EXE process. This file contains the
server-side version of the 32-bit user and GDI routines (graphics
engine). When a user selects the "Properties" item from the system menu
of a console window, a data structure containing information about the
console window is copied into the file-mapping object. The text of an
assert in the checked build appears to indicate that this structure is
called CONSOLE_STATE_INFO, which has the following structure:
typedef struct _CONSOLE_STATE_INFO
{
/* 0x00 */ DWORD cbSize;
/* 0x04 */ COORD ScreenBufferSize;
/* 0x08 */ COORD WindowSize;
/* 0x0c */ POINT WindowPosition;
/* 0x14 */ COORD FontSize;
/* 0x18 */ DWORD FontFamily;
/* 0x1c */ DWORD FontWeight;
/* 0x20 */ WCHAR FaceName[32]; /* Buffer Overflow */
/* 0x60 */ DWORD CursorSize;
/* 0x64 */ BOOL FullScreen;
/* 0x68 */ BOOL QuickEdit;
/* 0x6c */ BOOL DefaultWindowPos;
/* 0x70 */ BOOL InsertMode;
/* 0x74 */ WORD ScreenColors;
/* 0x76 */ WORD PopupColors;
/* 0x78 */ BOOL HistoryNoDup;
/* 0x7c */ DWORD HistoryBufferSize;
/* 0x80 */ DWORD NumberOfHistoryBuffers;
/* 0x84 */ COLORREF ColorTable[16];
/* 0xc4 */ DWORD CodePage;
/* 0xc8 */ DWORD hwnd;
/* 0xcc */ WCHAR ConsoleTitle[2];
} CONSOLE_STATE_INFO, *PCONSOLE_STATE_INFO;
The values contained within this struct are passed as a file-mapping
object to code within WINSRV.DLL that does not properly validate the
data. Passing a CONSOLE_STATE_INFO of all zero's can induce an integer
divide-by-zero exception in the CSRSS process that will cause the
process to terminate and the system to crash (blue screen) shortly
thereafter. The CONSOLE_STATE_INFO data structure contains a null
terminated string specifying the name of a font, FaceName[32]. This
string is copied into a fixed sized stack buffer without any sanity
checking via the wcscpy() function, as can be seen in the following
assembly excerpt from WINSRV.DLL on Windows 2000 Service Pack 4 Checked
Build:
0x5FFB39DF push [ebp+lpFaceName]
0x5FFB39E2 lea eax, [ebp-54h]
0x5FFB39E5 push eax
0x5FFB39E6 call j_wcscpy
By supplying a string longer than 32 bytes, an attacker can trigger the
stack-based buffer overflow to gain control of the computer and
eventually execute arbitrary code.
III. ANALYSIS
Exploitation allows local unprivileged users to potentially execute
arbitrary code on affected systems with SYSTEM privileges. An attacker
with non-privileged access to a vulnerable system can leverage this
vulnerability to fully compromise the underlying system. Exploitation of
the described vulnerability requires that the attacker be able to create
a console window. This attack may be used on public terminals to break
imposed restrictions that otherwise prevent users from fully controlling
the computer.
IV. DETECTION
iDEFENSE has confirmed the existence and exploitability of this
vulnerability in Microsoft Windows 2000 SP4 and Microsoft Windows XP
SP1a containing the following versions of CSRSS.EXE and WINSRV.DLL:
* Windows 2000 SP4 CSRSS.EXE - 5.0.2195.6601
* Windows 2000 SP4 WINSRV.DLL - 5.0.2195.6699
* Windows XP SP1a CSRSS.EXE - 5.0.2195.6601
* Windows XP SP1a WINSRV.DLL - 5.0.2195.6699
iDEFENSE has confirmed the existence of this vulnerability as a local
denial of service (blue screen) on Windows XP SP2 and Windows 2003. It
is believed that code execution may also be possible on these platforms,
though more difficult, as both platforms employ buffer overflow
exploitation prevention methods.
V. WORKAROUND
Restrict console access on public terminals where security is a concern.
This can be accomplished by creating the following registry key:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
Add a DWORD named DisableCMD with the value "1" to disable command
prompt and batch files or the value "2" to disable command prompt but
allow batch files.
VI. VENDOR RESPONSE
This vulnerability is addressed in Microsoft Security Bulletin MS05-018
available at:
http://www.microsoft.com/technet/security/Bulletin/MS05-018.mspx
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2005-0551 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
01/04/2005 Initial vendor notification
01/04/2005 Initial vendor response
04/12/2005 Coordinated public disclosure
IX. CREDIT
David Fritz is credited with this discovery.
Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.