From: Patrick (patrick@curioustechnology.com)
Date: Sat Aug 26 2006 - 05:29:37 EDT
Hi 3school,
First of all, they're exceptions, not acceptions ;).
The errors you're looking at need to be taken in context, so as a casual
reader, I don't have enough information to determine whether or not your
errors may lead to an exploitable condition. Your goal should be to trigger
a path of code execution that should not normally be possible if valid data
is provided to the application. Because it's a .net application, you're not
likely to be able to find a buffer overflow condition. There is an
exception to this rule (and this is a small sampling of all possible .net
scenarios) in that C# supports the [unsafe] keyword. It is theoretically
possible to create a c# application that is vulnerable to the traditional
stack smashing attacks, but I wouldn't hold my breath in the instance of
your app.
The first 3 errors you've referenced on their own look like simple
exceptions. They are common in instances when a developer has implemented
proper exception handling as well in instances when a dev has not.
The access violation exception looks to me like the application properly
rejects an attempt to write to an acl'd location (the hard disk or to the
registry, for example) when the app doesn't have permission to do so.
Probably not a lot to pursue there, but each application is unique.
The null reference exception occurs when an object is referenced that hasn't
been appropriately instantiated using the 'new' keyword. This would reflect
a bad coding technique- perhaps the object is instantiated elsewhere outside
of a while loop or in a different if/then branch. It might be interesting
to pursue.
The Invalid Object exception can happen anywhere. Some odd boxing might be
happening and the object is getting passed to function that expects a
different type of object. Again, reflects bad coding- the dev failed to
anticipate this condition. It might bbe interesting.
The Application Crash Dump is not really an error- it's the memory dump at
the point of failed code execution... If it were a non-.net application,
this might be an interesting piece of data for stack smashing, but not
useful in .net. IF you have the symbols, you may be able to reconstruct
what's going on at the stack (what memory values are where, what function
calls are being made, etc). However, .net has demonstrated great resilience
to shellcode type attacks. You're really going to be looking at a difficult
challenge in manipulating the ways an app writes data to disk if you're
looking to gain access to the machine. D.o.S. is a different matter,
however.
- HTH,
-P
-----Original Message-----
From: 3 shool [mailto:3shool@gmail.com]
Sent: Thursday, August 24, 2006 11:59 PM
To: pen-test@securityfocus.com
Subject: C# Exceptions
Hi,
I'm testing a C# desktop application. During my testing so far we have
found security issues that lead to application crash with following
type of errors:
1. Acess Violation Acception
2. Null Reference Acception
3. Invalid Object Acception
4. Application crash dump
Are these issues really a security threat for a desktop application?
We got these errors by sending junk data over the network replies that
this application gets from its web services. However I fail to
understand the security implication and risk of these exceptions.
Since this is a desktop application and not a web service or server
how would these issues impact the security of the desktop application.
The application doesn't open any port on the network for incoming
requests. What would be the best strategy to test such application?
What would be the points from where attacker could attack such a
aplication.
I'll really appreciate some enlightening thoughts on above queries.
Thanx in advance.
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:50 EDT