Unprotected Windows Messaging Channel ('Shatter')

Opis

The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.

Skutki

• Access Control

  Gain Privileges or Assume Identity; Bypass Protection Mechanism

Zapobieganie

• Architecture and Design

  Always verify and authenticate the source of the message.

Przykłady podatności

• CVE-2002-0971 Bypass GUI and access restricted dialog box.
• CVE-2002-1230 Gain privileges via Windows message.
• CVE-2003-0350 A control allows a change to a pointer for a callback function using Windows message.
• CVE-2003-0908 Product launches Help functionality while running with raised privileges, allowing command execution using Windows message to access "open file" dialog.
• CVE-2004-0213 Attacker uses Shatter attack to bypass GUI-enforced protection for CVE-2003-0908.
• CVE-2004-0207 User can call certain API functions to modify certain properties of privileged programs.

Słabość nadrzędna

• CWE-420 Unprotected Alternate Channel
• CWE-360 Trust of System Event Data

Kiedy powstaje

• Architecture and Design

Dotyczy

Not Language-Specific

Uwagi

Overlaps privilege errors and UI errors.

Possibly under-reported, probably under-studied. It is suspected that a number of publicized vulnerabilities that involve local privilege escalation on Windows systems may be related to Shatter attacks, but they are not labeled as such.

Alternate channel attacks likely exist in other operating systems and messaging models, e.g. in privileged X Windows applications, but examples are not readily available.

Źródła

1. Exploiting design flaws in the Win32 API for privilege escalation. Or... Shatter Attacks - How to break Windows — Paget, 2002
2. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 2, "Design Review." Page 34, Addison Wesley, 2006
3. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 12, "Shatter Attacks", Page 694, Addison Wesley, 2006