251839 - talkback.dll uses an API call with known security flaws

Status: RESOLVED WONTFIX

(Core Graveyard :: Talkback Client, defect)

Description

[Brant Gurganus]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040707 Firefox/0.9.2

talkback.dll uses the WinExec method call to launch the Talkback client.  This
method call has known security flaws, and I have been able to exploit them on my
system.

Reproducible: Always
Steps to Reproduce:
1. Create an executable at C:\program.exe
2. Cause Firefox to crash.
Actual Results:  
C:\program.exe is executed instead of the Talkback client.

Expected Results:  
It should use the more secure CreateProcess or CreateProcessAsUser functions.

I reported this over a year ago to [e-mail] and received no response
about it since.  With heightened awareness of security lately, it was probably
time to bring it up again in a place where it hopefully won't get lost.  It is
also a known vulnerability that is documented in the Windows API documentation
on MSDN:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/winexec.asp

This vulnerability can be programmatically found using Windows Application
Verifier from Microsoft which is a free utility.

In order to exploit this vulnerability, the following would need to take place
(assuming a path to the talkback executable of C:\Program Files\Mozilla
Firefox\components\talkback.exe:
 * The user must somehow get an executable at C:\program.(executable extension)
or C:\Program Files\mozilla.(executable extension).  This is probably quite easy
through social engineering.
 * The user must either have a crash in queue to be sent by the Talkback
software or somebody must cause the browser to crash.  This is quite easy given
that crash bug reports are publically available.

Comment 1

[Daniel Veditz [:dveditz]]

Clearing confidential flag, if you can get a program of your choosing installed
as c:\program.exe then you've already won. It's still a local exploit, though.
We should fix it if we can get a new version of talkback out of AOL.

Comment 2

[Daniel Veditz [:dveditz]]

We're no longer supporting Talkback