iDEFENSE Security Advisory 03.19.03: Heap Overflow in Windows Script Engine

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

iDEFENSE Security Advisory 03.19.03:
http://www.idefense.com/advisory/03.19.03.txt
Heap Overflow in Windows Script Engine
March 19, 2003

I. BACKGROUND

Microsoft Corp.'s Windows Script Engine within the Windows operating
system (OS) interprets and executes script code written in scripting
languages such as VBscript and JScript. Such script code can be used to
add functionality to web pages, or to automate tasks within the OS or a
program. Script code can be written in several different scripting
languages, such as Visual Basic Script, JScript or JavaScript.

II. DESCRIPTION

By passing malicious JavaScript via Internet Explorer (IE), Outlook or
Outlook Express, remote attackers can exploit an integer overflow within
the Windows Script Engine causing a corruption of the heap thereby
allowing for arbitrary code execution. Specifically, the vulnerability
lies in the Windows Script Engine's implementation of JScript that is
provided by jscript.dll (located in %SystemRoot%\system32). The following
snippet of JavaScript code demonstrates the existence of the vulnerability
by crashing IE on a vulnerable Windows system:

<script>
var trigger = [];
i = 1;
do {trigger[i] = 1;} while(i++ < 10000);
trigger[0x3FFFFFFF] = 1;
trigger.sort(new Function("return 1"));
</script>

The internal affected function, JsArrayFunctionHeapSort, creates two
arrays on the heap - one of size 4 * (MaxElementIndex + 1) and one of size
20 * (MaxElementIndex + 1). In the above example, MaxElementIndex is
0x3FFFFFFF. When it is incremented and multiplied by four, an integer
overflow occurs, thereby causing the application to allocate memory for an
array of size 0. Indexes within the trigger array can then be used to
overwrite segments of the second array that are filled with a structure
for each element being sorted. Arbitrary code execution is possible by
overwriting the heap control blocks to replace the stored address of
soon-to-be-called functions with the address of shellcode that is stored
in memory.

III. ANALYSIS

Exploitation requires an attacker first create a malicious JavaScript
snippet containing shellcode. Once accomplished, any of a number of attack
vectors are possible. Some include social engineering a user into browsing
to a malicious web page, sending a malicious HTML-enabled e-mail to the
target user, redirecting the user to the malicious script by leveraging
numerous cross-site scripting (XSS) vulnerabilities that are in existence,
or exploiting the browser directly using an XSS attack with embedded
JavaScript. iDEFENSE has verified these issues with working exploit code.

This is a serious issue because, given working exploit code under the
above scenarios, an attacker can cause any command to execute under the
privileges of the targeted user. The problem is further magnified when
taking into consideration the countless number of applications that
utilize the IE browsing engine, such as Outlook and Outlook Express.

IV. DETECTION

iDEFENSE has confirmed the existence of the above-described vulnerability
in the following Windows environments:

* Microsoft Windows 98
* Microsoft Windows 98 Second Edition
* Microsoft Windows Me
* Microsoft Windows NT 4.0
* Microsoft Windows NT 4.0 Terminal Server Edition
* Microsoft Windows 2000
* Microsoft Windows XP

with Jscript.dll versions:

* 5.1.0.4615 
* 5.5.0.6330 
* 5.6.0.6626 

V. WORKAROUND

Disable active scripting if it is not necessary for day-to-day operations
using the following steps:

1. In IE, click on Tools and select Internet Options from the drop-down
   menu.
2. Click the Security tab and the Custom Level button.
3. Under Scripting, then Active Scripting, click the Disable radio button.

In the HTML-enabled e-mail scenario, if the user were using Outlook
Express 6.0 or Outlook 2002 in their default configurations, or Outlook 98
or 2000 in conjunction with the Outlook Email Security Update, then an
attack could not be automated and the user would still need to click on a
URL sent in the e-mail. As such, Outlook 98 and 2000 users should install
the update, which is available at
http://office.microsoft.com/Downloads/2000/Out2ksec.aspx .

VI. VENDOR FIX

Microsoft has patched this vulnerability, upgrading jscript.dll to version
5.6.0.8513. Various incarnations of the fix are available from
http://www.microsoft.com/technet/security/bulletin/MS03-008.asp .

VII. CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project
assigned the identification number CAN-2003-0010 to this issue.

VIII. DISCLOSURE TIMELINE

07/07/2002 Microsoft initially notified
12/07/2002 Issue disclosed to iDEFENSE
01/09/2003 iDEFENSE notification sent to Microsoft ([email protected])
01/10/2003 Response received from [email protected]
01/10/2003 iDEFENSE clients notified
01/11/2003 to 03/18/2003 No less than eight e-mails requesting status
reports on patch status
03/19/2003 Public disclosure

IX. CREDIT

Roland Postle ([email protected]) discovered this vulnerability.

Get paid for security research
http://www.idefense.com/contributor.html

Subscribe to iDEFENSE Advisories:
send email to [email protected], subject line: "subscribe"

About iDEFENSE:

iDEFENSE is a global security intelligence company that proactively
monitors sources throughout the world — from technical
vulnerabilities and hacker profiling to the global spread of viruses
and other malicious code. Our security intelligence services provide
decision-makers, frontline security professionals and network
administrators with timely access to actionable intelligence
and decision support on cyber-related threats. For more information,
visit http://www.idefense.com .

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBPnkDcfrkky7kqW5PEQL+fACg01awKreePU4Xn+F7cmmU0qZvG7oAoPX2
PwP5JPQ8yomJWstofKnHgxxV
=KPqR
-----END PGP SIGNATURE-----