[SEC-1 LTD] RSA SecurID Web Agent Heap Overflow

[Gary O'leary-Steele]

SEC-1 LTD.
www.sec-1.com

Security Advisory

Advisory Name: RSA SecurID Web Agent Heap Overflow
Release Date: 06-05-2005
Application: RSA SecurID Web Agent 5
RSA SecurID Web Agent 5.2
RSA SecurID web Agent 5.3
Platform: Windows 2000 / IIS
Severity: Remote Code Execution
Author: Gary O'leary-Steele
Reported: See time line section below
Vendor status: See vendor statement in vendor response below
CVE Candidate: CAN-2005-XXXX Requested
Reference: http://www.sec-1.com/


Overview:

RSA SecurID(R) is a popular strong authentication package deployed using a
number of variety of hardware or software authentication tokens.

RSA SecurID(R) two-factor authentication is based on something you know (a
password or PIN), and something you have (an authenticator) - providing a
much more reliable level of user authentication than reusable password.


Details:

Sec-1 has identified a exploitable Heap Overflow within the Web Agent which
could be used to execute code with LocalSystem privileges. Using the
chunked-encoding mechanism to send a large "chunk" of data it is possible to
overwrite critical portions of the heap which could lead to remote code
execution or a denial of service condition. Sec-1 were able to exploit this
vulnerability to gain remote access to a Windows IIS installation (Windows
2000
SP4 + all current MS Patches) with the RSA SecurID web agent installed.

A proof of concept exploit has been provided to RSA.


Exploit Availability:

Sec-1 do not release exploit code to the general public. Attendees of the
Sec-1 Applied Hacking & Intrusion prevention course will recieve a copy of
this exploit as part of the Sec-1 Exploit Arsenal. Requests for a working
exploit will only be considered from professional IT Security Companies.

Time Line:

29-02-2004 - Directly contacted RSA via all publc addresses,
worked with another securty consultancy in attempt to contact
RSA product security team.
04-2005 - RSA contacted via telephone
15-04-2005 - NISCC informed (http://www.niscc.gov.uk/)
18-04-2005 - Reverse shell proof of concept sent to RSA for v5.2 of product
18-04-2005 - RSA send version 5.3 of product of testing
19-05-2005 - Initial proof of concept sent to RSA for v5.3 of product
21-04-2005 - RSA confirm crash within product
22-04-2005 - Reliable reverse shell proof of concept sent to RSA for v5.3
of
product
25-04-2005 - RSA send patch for testing
05-05-2005 - RSA release patch
06-05-2005 - Disclosure

Vendor Status: Fix Available

Vendor Response:

RSA have made a patch availible for this vulnerability:

To get this new patch and documentation, log on to RSA SecurCare Online at
https://knowledge.rsasecurity.com and click "Downloads" in the left
navigation menu. Then, click "Fixes by Product", click "RSA SecurID", and
"Authentication Agent 5.x", and select the downloads and documentation that
pertain to your environment.

Special Thanks:

Sec-1 Ltd would like to thank Ollie Whitehouse and Brett Moore for their
assisance in reporting this issue

Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.


CAN-2005-XXXX Requested


Copyright 2005 Sec-1 LTD. All rights reserved.


******************************************************************************************************************************************************************
NEW: Sec-1 Hacking Training - Learn to breach network security to further your knowledge and protect your network http://www.sec-1.com/applied_hacking_course.html
******************************************************************************************************************************************************************
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Kevin]

Post by Gary O'leary-Steele
29-02-2004 - Directly contacted RSA via all publc addresses,
worked with another securty consultancy in attempt to contact
RSA product security team.
04-2005 - RSA contacted via telephone

On the SEC-1 web site, they are listed as a "RSA SecurWorld Select
Partner", an honor they've held since at least 2002. Is RSA so
unresponsive to security flaw reports that they do not respond even to
their "select partners"?

I just now noticed Gary Oleary-Steele's Full-Disclosure+Bugtraq posts
of 18-Mar-2005 looking for a RSA security contact. I wish I would
have noticed them at the time, but I filter both lists so I only see
messages containing certain keywords (such as "SecurID"), and thus I
missed reading that post.

--
Unofficial SecurID User's group:
http://groups.yahoo.com/group/securid-users/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Vin McLellan]

Kevin quoted GaryO's vulnerability report and asked the obvious question: Huh?

Post by Kevin

Post by Gary O'leary-Steele
29-02-2004 - Directly contacted RSA via all publc addresses,
worked with another securty consultancy in attempt to contact
RSA product security team.
04-2005 - RSA contacted via telephone

Jumped off the page for me too. There was clearly a screw up somewhere if
Gary couldn't get through to RSA, in the UK or the US. I suspect a couple
of RSA senior managers are already climbing down through the ranks with
blow-torches to make sure that nothing like this can happen again.

I'm a consultant to RSA and I'll try to report back to the list on what
changes are made.

I would be very surprised if this incident does not it quickly lead RSA to
revamp whatever procedures it has for handling such a report -- at the very
least, publicly designate of a clear point of contact for external reports
of security vulnerabilities in RSA products. I expect a new policy along
the lines recently recommended by the Organization for Internet Safety.
(See: <www.oisafety.com>.)

[OIS, as regularly on this list probably know, is a consortium of
vendors -- MS, Oracle, ISS, and Symantec (publisher of Bugtraq), among
others -- and a few of the aggressive security consultancies (@stake,
Foundstone, etc.) that regularly develop reports of security
vulnerabilities. OIS came out with a very useful consensus.]

Post by Kevin
On the SEC-1 web site, they are listed as a "RSA SecurWorld Select
Partner", an honor they've held since at least 2002. Is RSA so
unresponsive to security flaw reports that they do not respond even to
their "select partners"?

RSA distributors and resellers have their own priority channels by which
they are able to report to RSA on problems with a product. I don't know
what happened here, but I suspect Mr. O'leary-Steele chose not to use them,
for his own reasons. That should not have made a material difference, of
course. Even anonymous emails about security issues are routed to RSA Tech
Support staff for review.

With its roots in the crypto culture -- where open critical review is a
valued part of the process by which a technology is vetted and tested -- I
think RSA has always been petty responsive to external critiques if RSA
judged them substantive. YMMV.

I expect there will be a quick internal review and then RSA do what it must
to make sure that this sort of "disconnect" can't happen again. I'm only a
consultant to RSA, but it is clear to me that the sort of time-lag reported
here is unacceptable. RSA is full of people, top to bottom, who would
immediately acknowledge that.

I think, frankly, that RSA just outgrew an informal assumption that all or
most product issues would be reported up through customer tech support,
sales, or partner channels. Someone at RSA should have recognized,
earlier, that this is now a silly assumption and done something about it.
After this incident, I expect someone -- very quickly -- now will.

Post by Kevin
I just now noticed Gary Oleary-Steele's Full-Disclosure+Bugtraq posts
of 18-Mar-2005 looking for a RSA security contact. I wish I would
have noticed them at the time, but I filter both lists so I only see
messages containing certain keywords (such as "SecurID"), and thus I
missed reading that post.

I'm embarrassed to admit that I somehow missed them too. Sorry, Gary. Mea
Culpa. Thank you for your persistence.

Suerte,
_Vin

Vin McLellan + The Privacy Guild + <***@theworld.com>
22 Beacon St., Chelsea, MA 02150


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/