II Sheriff Night

No dia 16 de março realizamos a segunda edição do Sheriff Night. Com um excelente suporte da STS, o evento teve a presença de membros da comunidade de segurança da informação que assistiram a uma pequena apresentação institucional sobre a Conviso e depois o Nelson Murilo, falando sobre resposta a incidentes.

Agradecemos imensamente a presença dos convidados que puderam nos dar a oportunidade de sua presença. Confira as fotos no web site da STS, e abaixo um vídeo mostrando um pouco de como o evento aconteceu.

Related Posts Word Press Plugin Cross Site Scripting Vulnerability - CVE-2011-0760

Introduction

Copyright and Disclaimer

The information in this advisory is Copyright 2010 Conviso and provided so that the society can understand the risk they may be facing by running affected software, hardware or other components used on their systems. In case you wish to copy information from this advisory, you must either copy all of it or refer to this document (including our URL). No guarantee is provided for the accuracy of this information, or damage you may cause your systems in testing.

About Conviso

Conviso is a consulting company specialized on application security. Our values are based on the allocation of the adequate competencies on the field, a clear and direct speech with the market, collaboration and partnership with our customers and business partners and constant investments on methodology and research improvement.

This advisory has been discovered as part of a general investigation into the security of software used in the IT environments of our customers. For more information about our company and services provided, please check our website at www.conviso.com.br.

The Security Research

Conviso maintains a virtual team dedicated to explore our customer’s environments in order to identify technical vulnerabilities in software and hardware, developing real-world mitigation solutions and processes to maintain more secure environments. Leaded by Wagner Elias, our CTO, this team is named Conviso Labs and also contribute to important world-class organizations projects and organizations.

The vulnerability described in this security advisory was discovered by Gabriel Quadros on December 22nd 2010 during a internal security research.

Security Advisory

Issue Description

The WordPress Related Posts Plugin, available at http://WordPress.org/extend/plugins/wp-related-posts/ shows the posts related to others posts. This advisory describes multiple Stored Cross Site Scripting (XSS) vulnerabilities and one Cross Site Request Forgery (CSRF) vulnerability on  the plugin.

As a result, an attacker can gain elevated access privileges to sensitive page content, session cookies, and a variety of other information maintained by the web browser on behalf of the WordPress administrator. Furthermore, the attacker can perform actions with administrative privileges.

Affected Components

This problem was confirmed in the latest version of the plugin - WP Related Posts 1.0, other versions maybe also affected.

CVSS Scoring System

Conviso calculated the scores using the online CVSS calculator found at http://www.patchadvisor.com/PatchAdvisor/CVSSCalculator.aspx and described at http://www.first.org/cvss/cvss-guide.pdf.

The CVSS score is: 6.4

• Base Score: 6.7


• Temporal Score: 6.4

We used the following values to calculate the scores:

• Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:N


• Temporal score is: E:F/RL:U/RC:C

Details

The plugin's configuration page is vulnerable to Stored Cross Site Scripting. The three fields wp_relatedposts_ title, wp_relatedposts_num and wp_relatedposts_type are received through POST or GET and included on the response page with inadequate sanitization. The vulnerable code is shown bellow:

158: <tr valign="top">

159:        <th scope="row">Title:</th>

160:                        <td><input type="text"

name="wp_relatedposts_title" value="<?=$options['

title']?>"></td>

161: </tr>

162: <tr valign="top">

163:        <th scope="row">Number posts:</th>

164:                        <td><input type="text"

name="wp_relatedposts_num" value="<?=$options['

count']?>"></td>

165: </tr>

166: <tr valign="top">

167:        <th scope="row">Related on:</th>

168:                        <td>

169:                                        <select name="wp_relatedposts_type">

170:                                                        <option

selected value="<?=$options['type']?>"><?=$options['type']?></option>

171:                                                        <option

value="Tags">Tags</option>

172:                                                        <option

value="Category">Category</option>

173:                                                        </select>

174:                        </td>

Another vulnerable piece of code is the one which prints the related posts list. The title, eceived through the parameter wp_relatedposts_title, is included with little sanitization into suchs lists. The vulnerable code is shown bellow:

79: $relatedpost.= '<br><br><br><h3>' . $options['title'] . '</h3><ul>';

(...)

120: $relatedpost.= '<br><br><br><h3>' . $options['title'] . '</h3><ul>';

These vulnerabilities allow an attacker to insert HTML/JavaScript commands to be interpreted in the session of an authenticated administrator. Since the plugin's configuration page is not protected against Cross Site Request Forgery, the exploitation permits the attacker to inject configuration values. Proof of concept exploitation code is available to interested parties.

Issue Mitigation

The developers have not provided a patch or workaround. The solution should add code to sanitize the values before including them using the htmlspecialchars() function or equivalent. Furthermore, a mechanism to protect against the CSRF is needed to prevent an attacker from changing the plugin's configuration.

Additional Information

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2011-0760 to this issue.

Security Advisory: Recaptcha Word Press Plugin Cross Site Scripting Vulnerability | CVE 2011-0759

Introduction

Copyright and Disclaimer

The information in this advisory is Copyright 2010 Conviso and provided so that the society can understand the risk they may be facing by running affected software, hardware or other components used on their systems. In case you wish to copy information from this advisory, you must either copy all of it or refer to this document (including our URL). No guarantee is provided for the accuracy of this information, or damage you may cause your systems in testing.

About Conviso

Conviso is a consulting company specialized on application security. Our values are based on the allocation of the adequate competencies on the field, a clear and direct speech with the market, collaboration and partnership with our customers and business partners and constant investments on methodology and research improvement.

This advisory has been discovered as part of a general investigation into the security of software used in the IT environments of our customers. For more information about our company and services provided, please check our website at www.conviso.com.br.

The Security Research

Conviso maintains a virtual team dedicated to explore our customer’s environments in order to identify technical vulnerabilities in software and hardware, developing real-world mitigation solutions and processes to maintain more secure environments. Leaded by Wagner Elias, our CTO, this team is named Conviso Labs and also contribute to important world-class organizations projects and organizations.

The vulnerability described in this security advisory was discovered by Gabriel Quadros on December 22nd 2010 during a internal security research.

Security Advisory

Issue Description

The WordPress Recaptcha Plugin integrates reCAPTCHA antispam methods with WordPress including comment, registration, and email spam protection and is available at http://wordpress.org/extend/plugins/wp-recaptcha/.

This advisory describes multiple Stored Cross Site Scripting (XSS) vulnerabilities and one Cross Site Request Forgery (CSRF) vulnerability on the plugin.  As a result, an attacker can gain elevated access privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the WordPress administrator user. Furthermore, the attacker can perform actions administrative privileges.

Affected Components

This problem was confirmed in the latest version of the plugin - WP-reCAPTCHA 2.9.8.2, other versions maybe also affected.

CVSS Scoring System

Conviso calculated the scores using the online CVSS calculator found at http://www.patchadvisor.com/PatchAdvisor/CVSSCalculator.aspx and described at http://www.first.org/cvss/cvss-guide.pdf.

The CVSS score is: 6.4

• Base Score: 6.7


• Temporal Score: 6.4

We used the following values to calculate the scores:

• Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:N


• Temporal score is: E:F/RL:U/RC:C

Details

The plugin's configuration page is vulnerable to Stored Cross Site Scripting. Several fields are received through POST and included on the response page with inadequate sanitization. The vulnerable code is shown bellow:

749: <input name="recaptcha_opt_pubkey" id="recaptcha_opt_pubkey" size="40"

value="<?php echo $optionarray_def['pubkey']; ?>" />

753: <input name="recaptcha_opt_privkey" id="recaptcha_opt_privkey" size="40"

value="<?php echo $optionarray_def['privkey']; ?>" />

782: <input name="re_tabindex" id="re_tabindex" size="5" value="<?php echo

$optionarray_def['re_tabindex']; ?>" />

814: <input name="error_blank" id="error_blank" size="80" value="<?php

echo $optionarray_

def['error_blank']; ?>" />

818: <input name="error_incorrect" id="error_incorrect" size="80" value="<?php

echo $optionarray_def['error_incorrect']; ?>" />

865: <input name="mailhide_pub" id="mailhide_pub" size="40" value="<?php echo

$optionarray_def['mailhide_pub']; ?>" />

869: <input name="mailhide_priv" id="mailhide_priv" size="40" value="<?php echo

$optionarray_def['mailhide_priv']; ?>" />

888: <input name="mh_replace_link" id="mh_replace_link" size="40" value="<?php

echo $optionarray_def['mh_replace_link']; ?>" />

891: <input name="mh_replace_title" id="mh_replace_title" size="40" value="<?php

echo $optionarray_def['mh_replace_title']; ?>" />

As a result, an attacker may insert HTML/JavaScript commands to be interpreted in the session of an authenticated administrator and, as the plugin's configuration page is not protected against Cross Site Request Forgery, the exploitation can be used to inject configuration values and change the reCAPTCHA configuration, disabling CAPTCHA for comments and registration forms. Proof of concept exploitation code is available to interested parties.

Issue Mitigation

The developer did not provided a patch or workaround. The solution for this issue should add code to sanitize the values before including them using the htmlspecialchars() function or equivalent. Furthermore, a mechanism to protect against the CSRF is needed to prevent an attacker from changing the plugin's configuration.

Additional Information

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2011-0759 to this issue.

Entrevista concedida ao Correio Braziliense

As falhas ocorridas no web site do Enem motivaram a publicação de uma matéria no Correio Braziliense, onde o nosso CTO, Wagner Elias, foi entrevistado para dar a sua opinião sobre o problema ocorrido. Reproduzida abaixo, a matéria original está disponível aqui.

Para senador Cristovam Buarque, Enem é uma "série de descasos"

Débora Álvares e Alexandre Botão

O novo problema no Sistema de Seleção Unificada (Sisu) — mais uma vez expondo a fragilidade na segurança do site administrado pelo Ministério da Educação (MEC) — levou autoridades em educação a questionar o modo como o processo foi adotado pelo governo.

Ex-ministro da Educação, o senador Cristovam Buarque não aliviou em relação a mais uma confusão envolvendo o Exame Nacional do Ensino Médio (Enem): “É um descaso, nitidamente. Uma série de descasos, na verdade. Com o dinheiro público, com os estudantes e com a educação, de uma maneira geral”, lamentou.

Segundo Cristovam, que foi o primeiro titular da pasta no governo Lula, tanto a maneira como vem sendo aplicado o Enem quanto o processo de seleção e ingresso foram “empurrados sem qualquer preparo”: “É inconcebível que um sistema como esse apresente falhas sucessivas. A verdade é que, desde que começou, ele ainda não funcionou”.

À frente do MEC, Cristovam pensava em adotar um sistema que ele considera “ainda mais complexo”. A ideia — lembra o ex-ministro — era implementar o Programa de Avaliação Seriada (PAS) em todo o Brasil. “E logo naquele início de preparação, já era possível notar que seria fundamental um planejamento minucioso. Chegamos à conclusão que ele só sairia do papel se estivesse 100% pronto para ser aprovado no teste prático”, comparou.

O ex-diretor-geral do Instituto Nacional de Estudos e Pesquisas Educacionais (Inep) Pedro Demo segue essa linha. “Ficou muita coisa para arrumar.” Para o sociólogo da UnB, que esteve à frente do instituto em 1986 e em 1987, os problemas recorrentes, de fato, abalaram a credibilidade da prova. “As pessoas perderam a confiança e é isso que o Inep pretende recuperar agora.”

Segundo o ex-diretor-geral, esse é o principal motivo que levou à escolha de Malvina Tuttman, ex-reitora da Universidade Federal do Estado do Rio de Janeiro (UniRio), para ocupar a cadeira de presidente do Inep. “Ela tem um perfil de professora e foi reitora.”

Para Demo, no entanto, erros gerenciais, como as trocas das provas e os problemas nos cadernos, registrados no fim do ano passado, são imperdoáveis, assim como a divulgação de dados de estudantes pelo site do Sisu.

Erros primários

A mesma opinião tem o especialista em segurança da informação Wagner Elias. Gerente de pesquisa e desenvolvimento de uma empresa especializada em segurança de tecnologia da informação, ele diz que os recentes problemas no portal são primários. “Bastava ter pensado em segurança. Não é nenhum tipo de técnica muito sofisticada. São erros simples de corrigir”, ressalta.

Wagner destaca que as falhas estão na arquitetura e também na codificação do site. Outro problema apontado pelo especialista é a capacidade de resposta precária, que leva o portal a travar quando muito acessado. “As pessoas que produzem sites acabam desenvolvendo muito mais a parte de funcionalidade e esquecem da segurança.”

ASLR - Address Space Layout Randomization

Certamente o ASLR foi um dos mecanismos de segurança mais eficazes na contenção da explosão no número de explorações com sucesso no inicio do Século XXI. Inicialmente foi apresentado como solução genérica para problemas de buffer overflow. Explorações que assumiam que o aplicativo vulnerável seria carregado em memória usando blocos de endereços fixos foram invalidadas. Muito embora, pouco tempo depois técnicas para burlar a proteção tenham surgido, o custo para construção de um exploit funcional para essa categoria de vulnerabilidade aumentou significativamente.

As tentativas de exploração ficaram mais “ruidosas”, evidenciando padrões de ataques e fornecendo subsídos para construção de dispositivos de detecção automática. Atualmente, o ASLR é implementado nativamente nos sistemas operacionais mais populares. Esse artigo tem por objetivo apresentar um breve (i) histórico, (ii) descrever o funcionamento, (iii) apresentar uma análise qualitativa e (iv) apresentar as principais técnicas utilizadas parar contornar a proteção provida.

Leia no Scribd