Tag Archives: Buffer Overflow

Ubuntu Issues Security Updates for April 2016

In the first week of April Ubuntu issued security updates to address vulnerabilities responsibly disclosed (defined) in the Ubuntu kernel (defined). Each vulnerability addressed was assigned a separate CVE identifier (defined).

Why Should These Issues Be Considered Important?
While no severities were assigned by Ubuntu to these issues any issue within the kernel can be consider high to critical severity (if it is remotely exploitable) since if control of the kernel can be obtained an attacker can then use that control to carry out any action of their choice. Ubuntu does however mention that the most severe of these issues can potential lead to remote code execution (the ability for an attacker to remotely carry out any action of their choice on your Ubuntu device) while the remainder can lead to denial of service conditions (defined).

The types of vulnerabilities addressed are varied and range from use-after-free (defined) vulnerabilities to timing side channel attacks (defined, in this case exploiting the timing within the Linux Extended Verification Module (EVM)) to a buffer overflow (defined) and incorrect file descriptor handling (defined).

How Can I Protect Myself From These Issues?
Within Ubuntu’s security advisory they provide the steps to download the appropriate updates for the version of Ubuntu that you are using. In addition, a system reboot is required for these updates to take effect.

In addition, 3 recent security advisories listed below were also made by available by Ubuntu, please ensure that you have followed the steps within each to ensure that you are protected from these vulnerabilities:

USN-2917-3: Firefox regressions: Addresses 34x CVEs
USN-2951-1: OptiPNG vulnerabilities: Addresses 5x CVEs
USN-2950-1: Samba vulnerabilities: Addresses 8 CVEs (among them the Badlock issue)

Thank you.

ISC Releases Security Updates for BIND (January 2016)

On the 19th of January Internet Systems Consortium (ISC) released 2 security updates to address critical and medium severity denial of service issues (defined) within their BIND DNS software.

Why Should These Issues Be Considered Important?
This critical severity remotely exploitable vulnerability is caused by a buffer overflow (defined) within a guard feature intended to prevent such an overflow. If an overflow occurred, it could cause BIND to exit. Examples of possible ways (not an exhaustive list) for this vulnerability to be exploited are provided by ISC within their first security advisory for these issues. For the remaining medium severity remotely exploitable issue an error in how BIND interprets specifically formatted text could cause an assertion (defined) again resulting in the possible exiting of BIND.

These issues affect a large number of versions (listed below) of BIND making them ever more important to address:

Critical Severity Issue: 9.3.0->9.8.8, 9.9.0->9.9.8-P2, 9.9.3-S1->9.9.8-S3, 9.10.0->9.10.3-P2
Medium Severity Issue: 9.10.0->9.10.3-P2

In addition, as mentioned by ISC, versions 9.3 to 9.8 of BIND are considered end of life and will not be receiving updates to address the critical issue. Currently supported versions of BIND are listed here.

Moreover, according to ISC, the critical issue has no workarounds or known mitigations. The medium severity issue can be mitigated by disabling debug logging (but only as a temporary measure until the appropriate update can be applied).

How Can I Protect Myself from These Issues?
If you use BIND (it is included with Linux distributions e.g. Redhat, Ubuntu etc.) to provide any DNS services within your company/organization or you know anybody who may be affected by these issues, please follow the advice within ISC’s security advisories to install the necessary updates to resolve these issues:

CVE-2015-8704: Specific APL data could trigger an INSIST in apl_42.c
CVE-2015-8705: Problems converting OPT resource records and ECS options to text format can cause BIND to terminate.

Thank you.

Schneider Electric Releases Critical PLC Security Update

On the 17th of December 2015 the Schneider Electric Corporation released a critical security update to address a buffer overflow (defined) vulnerability within the following Modicon M340 PLC (Programmable Logic Controller) products:

  • BMXNOC0401
  • BMXNOE0100
  • BMXNOE0100H
  • BMXNOE0110
  • BMXNOE0110H
  • BMXNOR0200
  • BMXNOR0200H
  • BMXP342020
  • BMXP342020H
  • BMXP342030
  • BMXP3420302
  • BMXP3420302H and
  • BMXPRA0100

This issue was responsibly disclosed (defined) to Schneider by an independent security researcher named Nir Giller.

Why Should This Issue Be Considered Important?
This security vulnerability is of critical severity since an attacker would find it easy to exploit according to the information within the ICS-CERT security advisory. In addition, once exploited it can provide the attacker with the ability to carry out any instruction of their choice (in other words remote code execution) within the Schneider product. The only workaround is to block port 80 of the Schneider device using a firewall. However, given that port 80 is used for HTTP communication, this workaround will prove restrictive.

How Can I Protect Myself from This Issue?
Schneider have released an update for these products that addresses this issue. Please follow the directions within this ICS-CERT security advisory which also references the advisory from Schneider for this issue to install the necessary update.

The ICS-CERT advisory also provides further recommendations in an effort to prevent exploitation of this vulnerability.

If you are unsure about how to upgrade the firmware of the affected Schneider products that you are using, please contact Schneider Technical Support for assistance.

Thank you.

Security Vulnerabilities Disclosed in Kaspersky and FireEye Products

Over the weekend a security researcher, Tavis Ormandy discovered a zero day security vulnerability in Kaspersky Anti-virus 2015 and 2016. The issue was a buffer overflow issue (defined) and could be exploited remotely by visiting a website of an attacker’s choice or receiving specifically crafted data packets from an attacker via the internet connection of the device the Kaspersky product is protecting.

Kaspersky quickly responded to update it’s products to resolve this issue and mentioned that they wish to add further mitigation strategies to prevent an issue such as this being found in their products in the future. In addition, Kaspersky already uses Data Execution Prevention (DEP)(defined here and here) and Address Space Layout Randomization (ASLR)(defined) in order to complicate the exploitation of such overflow attacks. A copy of the statement released by Kaspersky is available at the end of this blog post.

If you are using any of Kaspersky’s security products to protect your device, please ensure that it is up to date to protect against this vulnerability being exploited. Further information on updating a selection of Kaspersky products is provided below:

Updating Kaspersky Anti-Virus 2016
Updating Kaspersky Internet Security 2016
Updating Kaspersky Total Security 2016

Links to 2015 and previous products are also provided within the above pages.

If you have any questions, you can contact Kaspersky for assistance. Links to their product forums are provided on the right hand side of this page with contact links for their support teams for business and home users located at the end of the same page.


In a separate disclosure Kristian Erik Hermansen, a security researcher provided details of 4 vulnerabilities in FireEye’s security appliances. In addition, a further 30 flaws were discovered by his joint work with another researcher Ron Perris.

An official advisory (PDF) was published by FireEye with regards to the initial 4 vulnerabilities disclosed by Hermansen. This document provides further information as well as how to obtain the appropriate updates and further recommended best practices. If you use any of the affected products, please follow the steps within the advisory to patch these issues as soon as possible.

I will continue to monitor these issues and will update this blog post as more information becomes available.

Update: 15th September 2015: Further vulnerabilities were patched by FireEye in their products as documented in this advisory. However no further details concerning the issues previously discussed have been made available. If you use any of FireEye’s NX, EX, CM, AX or FX products please ensure that they are running the most current release available from FireEye as mentioned in both FireEye advisories.

Thank you.

Lenovo Releases Security Update For Laptop and Desktop Systems

Earlier this month computer manufacturer Lenovo released a security update for a wide range of its laptop and desktop systems.

The security update affects the Lenovo Service Engine (LSE). This is a utility created by Lenovo that becomes part of the computers BIOS (see Aside below for a definition) that downloads an application known as OneKey Optimizer. This application downloads updates for the computer’s BIOS, drivers updates for hardware and installs applications that are usually pre-installed when the computer leaves the Lenovo factory. Finally the application also sends non-personally identifiable system data to Lenovo servers.

As explained by Lenovo in their security advisory (see links provided below) in collaboration with an independent security researcher and Microsoft security vulnerabilities were found in the LSE (which included a buffer overflow attack (see Aside 2 below for a definition) and an attempted connection to a Lenovo test server). The LSE used the Microsoft Windows Platform Binary Table (WPBT). Microsoft has since provided updated security guidelines for using this capability of Windows. Since the LSE no longer meets those guidelines, Lenovo has chosen to remove all components of the LSE from the affected Lenovo systems.

Why Should These Issues Be Considered Important?
According to the US-CERT, the flaws within the LSE could allow a remote attacker to take control of the Lenovo system.

How Can I Protect Myself From These Issues?
As recommended by Lenovo in their advisories for laptops and desktop systems (both advisories are different), please update the BIOS of the affected systems using the steps provided in those advisories. Once updated the LSE disabler tool can be used to remove the vulnerable LSE components.

Thank you.

What is a BIOS?

A Basic Input/Output System (BIOS) is the first piece of code that tells your computer what to do when it is first turned on. This involves 2 stages, the first stage involves a quick diagnostic of the computers components known as a power on self-test (POST).

The second stage involves brining your computer into a usable state by starting your operating system e.g. Linux, Mac OS X or Windows from the first bootable hard drive (or other drive) it locates.

The BIOS will also check for other bootable devices such as CDs/DVDs or USB jump drives. The goal being to find the next stage of the start-up process whether that be the much more common task of starting your operating system so that you can get to work or allowing you to repair computer or recover your data using emergency bootable discs/USB jump drives. Further information on computer BIOSes and how they are migrating to the newer Unified Extensible Firmware Interface (UEFI) architecture is available here.

Aside 2:
What is a Buffer Overflow attack?

A buffer is an area of computer memory set aside for a specific task. If data larger than that area is (attempted) to be stored in that area, that buffer will overflow. When an overflow happens the data that can fit in the buffer is stored in that buffer while the data that doesn’t fit spills over into memory adjacent to that buffer. Whatever data is stored in those locations is overwritten.

Within the overfilled memory areas (which now contain unintended data (from the point of view of another programs assuming they still contain valid data)) may have previously been another buffer, a programs data output or a pointer (defined below) to another area of memory.

At best this will result in the program using that value (that was overwritten) crashing or getting caught in an infinite loop (performing the same action again and again without ending). At worst, an attack could use a buffer overflow to their advantage.

This can result in an attacker being able to run/execute code of their choice by overwriting the return pointer of the program (due to the overflow that has happened) with a value of the attackers choosing. That value is placed there by the overspill into adjacent memory segments. When an operation is completed, instead of the program returning (using the location the return pointer is referencing) to the place where it was originally asked (called from) the program will instead go to the place in memory where the attacker has stored malicious code (since the attacker supplied this location by inserting a value of their choice (which is too large to fit in the buffer) as mentioned above).

A pointer is a variable (a segment of memory that stores a single value) that contains the address (in computer memory) of another variable.

The attacker’s code can then run with same privileges of the program which suffered the overflow. C and C++ functions (a set of instructions that carries out a specific action within a program) such as strcpy (string copy) and strcat(string concatenation/appending function) are just some examples of functions that are vulnerable to buffer overflows.

Such unsafe functions were replaced with functions that carried out the same task but checked the size of the input against the size of the buffer it was to be stored in and don’t allow an overflow to occur. These safe functions are now recommended by Microsoft. To enforce the use of safe functions the Banned Function Calls header file was created (also documented here). Other mitigations such as /GS cookies (discussed in a previous blog post) were also implemented to protect against buffer overflows.

Please note that it is only Microsoft that uses the newer safer functions mentioned above. Linux takes a different approach as does Apple but each results in safer code.

Update: 7th September 2015:
While the use of “safe” versions of common functions that operate on buffers are the preferred method of working with buffers, they are not perfect since they can suffer from incorrect calculations of the width of the buffer to allocate. If a mistake is made here by the programmer, a buffer overflow can still result. An example of a protected version of such a function (of the strcpy() function mentioned above) can be seen in the function declaration shown below that takes the width of the desired buffer as parameter would be:

strncpy(destination, source, width);

The above function declaration shows the name of the “safe” function, namely strncpy (notice the difference to the standard function with the name of strcpy, the “safe” function includes an extra “n”). The 3 parameters to this function are shown within the parentheses () otherwise known as brackets.

Update: 17th September 2015:
A detailed definition of a stack overflow is provided in a more recent blog post. This similar type of overflow can be a useful addition to the above explanation. Thank you.

A further reference for buffer overflow attacks is the following:

Smashing The Stack For Fun And Profit by Aleph One