鬼仔's Blog

Author: void[at]ph4nt0m[dot]org
Blog: http://hi.baidu.com/54nop
Team: http://www.ph4nt0m.org
Date: 2008-04-09

影响版本:
Foxmail <= 6.5 beta1(build015)

分析:
Foxmail的fmrsslink.dll控件里IRss接口AddUrl(URL, Info)方法未检查网页提供的rss链接长度,当用户通过IE右键菜单收藏超长rss链接至Foxmail时,将导致栈溢出.

.text:10001044 ; int __stdcall AddUrl(void *this_ptr, LPCWSTR lpURL, LPWSTR lpInfo)
.text:10001044 AddUrl proc near ; DATA XREF: .rdata:100041E0o
.text:10001044 ; .rdata:10004244o
.text:10001044
.text:10001044 str_Vuln = byte ptr -200h
.text:10001044 Parameters = byte ptr -100h
.text:10001044 this_ptr = dword ptr 8
.text:10001044 lpURL = dword ptr 0Ch
.text:10001044 lpInfo = dword ptr 10h
.text:10001044
.text:10001044 push ebp
.text:10001045 mov ebp, esp
.text:10001047 sub esp, 200h
.text:1000104D push esi
.text:1000104E push edi
.text:1000104F push [ebp+lpURL]
.text:10001052 call my_wsclen
.text:10001057 pop ecx
.text:10001058 mov ecx, [ebp+this_ptr]
.text:1000105B push eax ; length_lpURL,URL长度,未检查
.text:1000105C push [ebp+lpURL] ; lpURL
.text:1000105F lea eax, [ebp+str_Vuln]
.text:10001065 push eax ; str_Vuln 只有512字节
.text:10001066 call my_WideCharToMultiByte ; <==
.text:1000106B mov ecx, [ebp+this_ptr]
.text:1000106E call sub_100010D6 ; HeapAlloc()
.text:10001073 mov edi, eax
.text:10001075 mov esi, offset aRss_xml ; "RSS_XML:"
.text:1000107A lea eax, [ebp+Parameters]
.text:10001080 push esi
.text:10001081 push eax
.text:10001082 call sub_100038B0
.text:10001087 push esi
.text:10001088 call sub_10003830
.text:1000108D mov ecx, 0FFh
.text:10001092 sub ecx, eax
.text:10001094 lea eax, [ebp+str_Vuln]
.text:1000109A push ecx
.text:1000109B push eax
.text:1000109C lea eax, [ebp+Parameters]
.text:100010A2 push eax
.text:100010A3 call sub_10003700
.text:100010A8 add esp, 18h
.text:100010AB lea eax, [ebp+Parameters]
.text:100010B1 push 1 ; nShowCmd
.text:100010B3 push offset Directory ; lpDirectory
.text:100010B8 push eax ; lpParameters
.text:100010B9 push edi ; lpFile
.text:100010BA push offset Operation ; "open"
.text:100010BF push 0 ; hwnd
.text:100010C1 call ds:ShellExecuteA
.text:100010C7 push edi
.text:100010C8 call sub_100036E7 ; HeapFree()
.text:100010CD pop ecx
.text:100010CE pop edi
.text:100010CF xor eax, eax
.text:100010D1 pop esi
.text:100010D2 leave
.text:100010D3 retn 0Ch
.text:100010D3 AddUrl endp


解决方法:
2008年1月21日,漏洞上报腾讯.
2008年3月10日,腾讯发布关于此漏洞的修复补丁.用户升级Foxmail即可修复该漏洞.(点击Foxmail菜单"帮助"—>"检查新版本…").
QQ安全中心公告链接: http://safe.qq.com/affiche/2008/20080314.shtml