Synopsis
HP LoadRunner contains multiple flaws related to packet handling that can lead to a remote DoS, or one that could possibly lead to remote code execution, although that was not tested extensively.
#1: Multiple Service Connection Request xsr_string Field Handling NULL Pointer Dereference Remote DoS (HPSBGN03609 / CVE-2016-4361)
Affected: 11.52, 12.02. Not Affected: 12.50
Based on limited testing, since it appears to be fixed in the latest version, it is possible to trigger a NULL pointer dereference when sending the same packets to a combination of services based around magentservice.exe (the agent listens on multiple TCP ports including 54345, 50500, and 5003) and the xdr_string field in a connection request message. This was trivially reproduced by using Nessus with thorough_tests enabled, specifically the loadrunner_agent_detect.nasl, loadrunner_agent_service_ip_name_overflow.nasl, and hp_loadrunner_cve-2013-4800.nasl plugins.
(cd8.ccc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\HP\LoadRunner\launch_service\bin\launcher.dll -
eax=00000000 ebx=01a51940 ecx=8184f62f edx=70011000 esi=01a51a58 edi=01a51a58
eip=6ccc91d8 esp=021de114 ebp=01a519e8 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
launcher!mxdr_p_lg_status_response_t+0x2ed5e:
6ccc91d8 8b00 mov eax,dword ptr [eax] ds:0023:00000000=????????
#2: Malformed Packet Handling Remote DoS (HPSBGN03609 / CVE-2016-4361)
Affected: 9.5. Not Affected: 10.50, 12.02
A malformed packet set to TCP port 5001 or TCP port 5002 causes the crash. As of version 12.02), the service no longer listens on those ports effectively 'fixing' the issue. This can be performed using Nessus with thorough_tests enabled. Since fixed in the latest version, further testing was not performed.
#3: mchan.dll Packet Handling Invalid Memory Access Remote DoS (HPSBGN03648 / CVE-2016-4384)
Affected: 11.52, 12.02, 12.50
By sending a specially crafted packet to the LoadRunner agent listening on TCP port 54345, a remote attacker can crash the service. A "-server_type=6" request (LinkList server) without a "ll_server_index=..." declaration in a connection request triggers the invalid memory access, possibly due to ll_server_index being uinitialized. This has not been fully tested to determine if remote code execution is possible.
(658.33c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=9b7e9a20 ebx=01e4dcf8 ecx=003f7558 edx=00000434 esi=fffffffd edi=003f7558
eip=6f2a8851 esp=01e4dc68 ebp=01e4dcf8 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
mchan!mchan_post_message+0x2605f:
6f2a8851 8b10 mov edx,dword ptr [eax] ds:0023:9b7e9a20=????????
A quick note on the CVE assignments. Once both HP advisories were out, we used them to determine that the CVE assignments were not ideal. Ultimately, CVE-2016-4361 (SSRT102274) should have represented all three issues in this advisory. However, when HPSBGN03648 was published with CVE-2016-4384, looking at the affected / fixed versions tells us that represents #3. So CVE-2016-4361 would actually cover #1 and #2 in this advisory. Here is the breakdown including our internal tracking numbers:
CVE-2016-4359 (PSRT110020, ZDI-CAN-3516 / ZDI-16-363) = TRA-13 = TRA-2016-16 CVE-2016-4360 (PSRT110032, ZDI-CAN-3555 / ZDI-16-364) = TRA-27 = TRA-2016-17 CVE-2016-4361 (SSRT102274) = TRA-14 #1 / #2 /#3= TRA-2016-26 CVE-2016-4384 (PSRT110230) = TRA-14 #3 = TRA-2016-26
We are fairly confident that HP's internal records do not match this, but since we are the ones policing a CNA for not doing proper CVE assignments and us being involved with all of these disclosures, we are clearly stating the above to be the definitive CVE assignments.
Solution
HPE has released Performance Center v12.53 and LoadRunner v12.53 / v12.50 patch 3 to address these issues, we think. HPSBGN03648 says that "all versions prior to v12.50" are affected, implying 12.50 is the fix. However, they then say 12.50 patch 3 is the fix, implying 12.50 is vulnerable. We fully encourage you to reach out to HP and ask them for clarity if this impacts your organization.
Additional References
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]