Last Comment Bug 778686 - Blocklist npuplaypc.dll (uplaypc/Ubisoft Uplay) plugin
: Blocklist npuplaypc.dll (uplaypc/Ubisoft Uplay) plugin
Status: RESOLVED FIXED
: qawanted, sec-vector
Product: Toolkit
Classification: Components
Component: Blocklisting (show other bugs)
: unspecified
: All Windows 7
: -- blocker with 7 votes (vote)
: ---
Assigned To: Jorge Villalobos [:jorgev]
:
:
Mentors:
http://seclists.org/fulldisclosure/20...
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-30 03:32 PDT by Matthew Gregan [:kinetik]
Modified: 2016-03-07 15:30 PST (History)
21 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Screenshot of plugin block dialog. (33.95 KB, image/png)
2012-07-30 09:11 PDT, ferongr
no flags Details
live blocklist.xml (25.33 KB, text/plain)
2012-07-30 12:44 PDT, ferongr
no flags Details

Description Matthew Gregan [:kinetik] 2012-07-30 03:32:44 PDT
taviso has revealed that the Ubisoft Uplay plugin can be used to run executables at arbitrary paths on the user's filesystem from script with the user's privileges.  See the full-disclosure link for more details.
Comment 1 K. Gadd (:kael) 2012-07-30 03:42:07 PDT
http://pastehtml.com/view/c6gxl1a79.html reportedly contains a working POC for Firefox.
Comment 2 Christian Holler (:decoder) 2012-07-30 03:55:13 PDT
We should immediately stage a softblock for this plugin until an update is available, since exploiting this is trivial. Ubisoft has been informed by Tavis (and they are tracking it under #120729-000613), but it doesn't seem that an update is available yet.
Comment 3 John Drinkwater (:beta) 2012-07-30 06:45:07 PDT
Platform scope is larger than flagged too.
Comment 4 Jorge Villalobos [:jorgev] 2012-07-30 08:28:41 PDT
I staged the block: https://addons-dev.allizom.org/en-US/firefox/blocked/p103. I need someone with this plugin to test the block using these instructions: https://wiki.mozilla.org/Blocklisting/Testing

This block works will all versions up to 2.03. According to this article: http://www.rockpapershotgun.com/2012/07/30/psa-possible-security-risk-in-some-ubisoft-pc-games/, version 2.04 was released to close this hole. Can someone verify this?
Comment 5 ferongr 2012-07-30 09:00:54 PDT
I have the 2.03 installer. While the installed didn't manage to install the plugins , I extracted them from the NSIS installer package and put them in my System folder.

The plugins appear like so in about:plugins

Uplay PC

    File: C:\Windows\SysWOW64\npuplaypc.dll
    Version: 1.0.0.0
    Uplay PC Plugin

MIME Type 	Description 	Suffixes
application/x-uplaypc 	Uplay PC 	

Uplay PC Hub Plugin

    File: C:\Windows\SysWOW64\npuplaypchub.dll
    Version: 1.0.0.1
    0.3

MIME Type 	Description 	Suffixes
application/x-uplaypchub 	uplay_npapi 	foo

They have no version numbers. Furthermore, the link to the PoC does not produce any results on Win7 64 bit. Still, I'll install release and make sure the softblock works if it helps.
Comment 6 ferongr 2012-07-30 09:10:52 PDT
I installed release (14.0.1), created a new profile, verified the plugins were picked up by Fx, changed the blocklist URL and once I ran the code snippet to force a blocklist update I got a popup informing me about the block of Uplay PC, prompting me to restart.

Sorry for the bugspam, hope this was of help.
Comment 7 ferongr 2012-07-30 09:11:46 PDT
Created attachment 647196 [details]
Screenshot of plugin block dialog.
Comment 8 Jorge Villalobos [:jorgev] 2012-07-30 12:13:22 PDT
The plugin block is now in production: https://addons.mozilla.org/en-US/firefox/blocked/. I amended it so that it is a softblock, and the max version is now set to 1.0.0.0, since that's the current plugin version.

Please verify.
Comment 9 ferongr 2012-07-30 12:44:47 PDT
Created attachment 647254 [details]
live blocklist.xml

With the Uplay plugin enabled, and having created a new profile, forcing a blocklist ping results in no obvious effect. The blocklist.xml file updates normally as show by the file date modification attribute. Attached is the blocklist.xml as of 2 minutes ago. I couldn't find an entry for the Uplay plugin in it.
Comment 10 Jorge Villalobos [:jorgev] 2012-07-30 12:56:42 PDT
It might take an hour or two because of caching.
Comment 11 ferongr 2012-07-30 13:35:46 PDT
Yep, seems to work now.
Comment 13 lkawiak 2014-12-21 21:54:28 PST
[Tracking Requested - why for this release]:

Note You need to log in before you can comment on or make changes to this bug.