TeamSpeak Server sendCommandLowPacket use after free

Summaryinfo

A vulnerability was found in TeamSpeak Server. It has been declared as critical. The affected element is the function VirtualServerBase::sendCommandLowPacket. Such manipulation leads to use after free. Additionally, an exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in TeamSpeak Server (version now known). Affected by this issue is the function VirtualServerBase::sendCommandLowPacket. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability.

The weakness was released 08/12/2016 by Hanz Jenson as not defined mailinglist post (Full-Disclosure). The advisory is available at seclists.org. The vendor was not involved in the coordination of the public release. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a private exploit are known. The following code is the reason for this vulnerability:

0x49d26d:
call    _pthread_mutex_unlock
mov     rdi, client

; this will mov rax, [rdi+0F0h]
call    Client::getTransmissionReceiveBase(void)

mov     rcx, [rax]
mov     rdx, [rbx+VirtualServer.vsb.vserv_id]
mov     rdi, rax
mov     rsi, r14
call    qword ptr [rcx+58h]

As we can see, the mutex is unlocked and then a TransmissionReceiveBase struct is taken out of the Client. Then its vtable is used for a call. Looking at the kernel source we see that, at least on Linux, _pthread_mutex_unlock will swap out the current thread if there's another thread blocked waiting for the mutex. This other thread could then free the Client and place controlled data on top of the freed block. When the first thread runs again, we control the TransmissionReceiveBase object completely. The indirect call through its vtable allows us to get $pc.

It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-90867, VDB-90868, VDB-90869 and VDB-90870. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• TeamSpeak

Name

• Server

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion