JOAL 2.0-rc11 - Multiple Remote Code Execution Vulnerabilities
fuzzing, security, blackbox, tests, Java, JOGAMP, JOAL, OpenAL, RCE
JOAL 2.0-rc11 - Multiple Remote Code Execution Vulnerabilities
FMA-2012-038
[
CVE
CVE-2013-4099
]
[
OSVDB ID
96582
]
JOAL
2.0-rc11
http://jogamp.org/joal/www/
OpenAL.dll
6.14.357.24
235355A8DD26903E75D5E812ECF50E53
Windows 7 Home Premium
2012.10.10
2013.05.15
2013.08.21
Multiple Remote Code Execution Vulnerabilities in JOAL 2.0-rc11 java library.
RCE
FuzzMyApp team have identified multiple vulnerabilities in OpenAL32.dll, which leads to remote code execution.
OpenAL32.dll is distributed in signed jar files. It allows to create malicious applet which can exploit found vulnerabilities in order to execute arbitrary
code on target machine.
If user had not used any of JogAmp's libraries before, one needs to accept installation.
If user has a Sven Gothel certificate among Java trusted certificates (i.e. used JogAmp before),
no interaction is needed.
]]>
]]>
Vulnerable methods:]]>
01. jogamp.openal.ALImpl.dispatch.alAuxiliaryEffectSlotf1(IIFJ)V]]>
02. jogamp.openal.ALImpl.dispatch.alBuffer3f1(IIFFFJ)V]]>
03. jogamp.openal.ALImpl.dispatch.alBufferfv1(IILjava/lang/Object;IZJ)V]]>
04. jogamp.openal.ALImpl.dispatch.alDeleteEffects1(ILjava/lang/Object;IZJ)V]]>
05. jogamp.openal.ALImpl.dispatch.alEffectf1(IIFJ)V]]>
06. jogamp.openal.ALImpl.dispatch.alEffectfv1(IILjava/lang/Object;IZJ)V]]>
07. jogamp.openal.ALImpl.dispatch.alEffectiv1(IILjava/lang/Object;IZJ)V]]>
08. jogamp.openal.ALImpl.dispatch.alEnable1(IJ)V]]>
09. jogamp.openal.ALImpl.dispatch.alFilterfv1(IILjava/lang/Object;IZJ)V]]>
10. jogamp.openal.ALImpl.dispatch.alFilteriv1(IILjava/lang/Object;IZJ)V]]>
11. jogamp.openal.ALImpl.dispatch.alGenAuxiliaryEffectSlots1(ILjava/lang/Object;IZJ)V]]>
12. jogamp.openal.ALImpl.dispatch.alGenEffects1(ILjava/lang/Object;IZJ)V]]>
13. jogamp.openal.ALImpl.dispatch.alGenFilters1(ILjava/lang/Object;IZJ)V]]>
14. jogamp.openal.ALImpl.dispatch.alGenSources1(ILjava/lang/Object;IZJ)V]]>
15. jogamp.openal.ALImpl.dispatch.alGetAuxiliaryEffectSlotiv1(IILjava/lang/Object;IZJ)V]]>
16. jogamp.openal.ALImpl.dispatch.]]>alGetBuffer3f1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V]]>
17. jogamp.openal.ALImpl.dispatch.]]>alGetBuffer3i1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V]]>
18. jogamp.openal.ALImpl.dispatch.alGetBufferf1(IILjava/lang/Object;IZJ)V]]>
19. jogamp.openal.ALImpl.dispatch.alGetBufferiv1(IILjava/lang/Object;IZJ)V]]>
20. jogamp.openal.ALImpl.dispatch.alGetDoublev1(ILjava/lang/Object;IZJ)V]]>
21. jogamp.openal.ALImpl.dispatch.alGetEffectf1(IILjava/lang/Object;IZJ)V]]>
22. jogamp.openal.ALImpl.dispatch.alGetEffectfv1(IILjava/lang/Object;IZJ)V]]>
23. jogamp.openal.ALImpl.dispatch.alGetEffectiv1(IILjava/lang/Object;IZJ)V]]>
24. jogamp.openal.ALImpl.dispatch.alGetEnumValue1(Ljava/lang/String;J)I]]>
25. jogamp.openal.ALImpl.dispatch.alGetFilteri1(IILjava/lang/Object;IZJ)V]]>
26. jogamp.openal.ALImpl.dispatch.alGetFilteriv1(IILjava/lang/Object;IZJ)V]]>
27. jogamp.openal.ALImpl.dispatch.alGetFloat1(IJ)F]]>
28. jogamp.openal.ALImpl.dispatch.alGetFloatv1(ILjava/lang/Object;IZJ)V]]>
29. jogamp.openal.ALImpl.dispatch.]]>alGetListener3f1(ILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V]]>
30. jogamp.openal.ALImpl.dispatch.]]>alGetListener3i1(ILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V]]>
31. jogamp.openal.ALImpl.dispatch.alGetListenerf1(ILjava/lang/Object;IZJ)V]]>
32. jogamp.openal.ALImpl.dispatch.alGetListeneri1(ILjava/lang/Object;IZJ)V]]>
33. jogamp.openal.ALImpl.dispatch.alGetListeneriv1(ILjava/lang/Object;IZJ)V]]>
34. jogamp.openal.ALImpl.dispatch.alGetProcAddress1(Ljava/lang/String;J)J]]>
35. jogamp.openal.ALImpl.dispatch.alGetProcAddressStatic(Ljava/lang/String;J)J]]>
36. jogamp.openal.ALImpl.dispatch.]]>alGetSource3f1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V]]>
37. jogamp.openal.ALImpl.dispatch.]]>alGetSource3i1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V]]>
38. jogamp.openal.ALImpl.dispatch.alGetSourcef1(IILjava/lang/Object;IZJ)V]]>
39. jogamp.openal.ALImpl.dispatch.alGetSourcefv1(IILjava/lang/Object;IZJ)V]]>
40. jogamp.openal.ALImpl.dispatch.alGetSourcei1(IILjava/lang/Object;IZJ)V]]>
41. jogamp.openal.ALImpl.dispatch.alGetSourceiv1(IILjava/lang/Object;IZJ)V]]>
42. jogamp.openal.ALImpl.dispatch.alGetString1(IJ)Ljava/lang/String;]]>
43. jogamp.openal.ALImpl.dispatch.alIsAuxiliaryEffectSlot1(IJ)Z]]>
44. jogamp.openal.ALImpl.dispatch.alIsBuffer1(IJ)Z]]>
45. jogamp.openal.ALImpl.dispatch.alIsEffect1(IJ)Z]]>
46. jogamp.openal.ALImpl.dispatch.alIsExtensionPresent1(Ljava/lang/String;J)Z]]>
47. jogamp.openal.ALImpl.dispatch.alIsFilter1(IJ)Z]]>
48. jogamp.openal.ALImpl.dispatch.alListener3f1(IFFFJ)V]]>
49. jogamp.openal.ALImpl.dispatch.alListener3i1(IIIIJ)V]]>
50. jogamp.openal.ALImpl.dispatch.alListenerf1(IFJ)V]]>
51. jogamp.openal.ALImpl.dispatch.alListenerfv1(ILjava/lang/Object;IZJ)V]]>
52. jogamp.openal.ALImpl.dispatch.alListeneri1(IIJ)V]]>
53. jogamp.openal.ALImpl.dispatch.alListeneriv1(ILjava/lang/Object;IZJ)V]]>
54. jogamp.openal.ALImpl.dispatch.alSource3f1(IIFFFJ)V]]>
55. jogamp.openal.ALImpl.dispatch.alSource3i1(IIIIIJ)V]]>
56. jogamp.openal.ALImpl.dispatch.alSourcef1(IIFJ)V]]>
57. jogamp.openal.ALImpl.dispatch.alSourcefv1(IILjava/lang/Object;IZJ)V]]>
58. jogamp.openal.ALImpl.dispatch.alSourcei1(IIIJ)V]]>
59. jogamp.openal.ALImpl.dispatch.alSourceiv1(IILjava/lang/Object;IZJ)V]]>
60. jogamp.openal.ALImpl.dispatch.alSourcePause1(IJ)V]]>
61. jogamp.openal.ALImpl.dispatch.alSourcePausev1(ILjava/lang/Object;IZJ)V]]>
62. jogamp.openal.ALImpl.dispatch.alSourcePlay1(IJ)V]]>
63. jogamp.openal.ALImpl.dispatch.alSourcePlayv1(ILjava/lang/Object;IZJ)V]]>
64. jogamp.openal.ALImpl.dispatch.alSourceQueueBuffers1(IILjava/lang/Object;IZJ)V]]>
65. jogamp.openal.ALImpl.dispatch.alSourceRewindv1(ILjava/lang/Object;IZJ)V]]>
66. jogamp.openal.ALImpl.dispatch.alSourceStop1(IJ)V]]>
67. jogamp.openal.ALImpl.dispatch.alSourceStopv1(ILjava/lang/Object;IZJ)V]]>
68. jogamp.openal.ALImpl.dispatch.alSourceUnqueueBuffers1(IILjava/lang/Object;IZJ)V]]>
69. jogamp.openal.ALImpl.dispatch.alSpeedOfSound1(FJ)V]]>
]]>
Malformed methods params allow to full control of EIP register.
Crash dumps are avaliable below.
crashlogs/alAuxiliaryEffectSlotf1.log
alAuxiliaryEffectSlotf1(IIFJ)V crashdump
crashlogs/alBuffer3f1.log
alBuffer3f1(IIFFFJ)V crashdump
crashlogs/alBufferfv1.log
alBufferfv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alDeleteEffects1.log
alDeleteEffects1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alEffectf1.log
alEffectf1(IIFJ)V crashdump
crashlogs/alEffectfv1.log
alEffectfv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alEffectiv1.log
alEffectiv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alEnable1.log
alEnable1(IJ)V crashdump
crashlogs/alFilterfv1.log
alFilterfv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alFilteriv1.log
alFilteriv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGenAuxiliaryEffectSlots1.log
alGenAuxiliaryEffectSlots1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alGenEffects1.log
alGenEffects1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alGenFilters1.log
alGenFilters1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alGenSources1.log
alGenSources1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetAuxiliaryEffectSlotiv1.log
alGetAuxiliaryEffectSlotiv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetBuffer3f1.log
alGetBuffer3f1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V crashdump
crashlogs/alGetBuffer3i1.log
alGetBuffer3i1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V crashdump
crashlogs/alGetBufferf1.log
alGetBufferf1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetBufferiv1.log
alGetBufferiv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetDoublev1.log
alGetDoublev1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetEffectf1.log
alGetEffectf1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetEffectfv1.log
alGetEffectfv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetEffectiv1.log
alGetEffectiv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetEnumValue1.log
alGetEnumValue1(Ljava/lang/String;J)I crashdump
crashlogs/alGetFilteri1.log
alGetFilteri1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetFilteriv1.log
alGetFilteriv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetFloat1.log
alGetFloat1(IJ)F crashdump
crashlogs/alGetFloatv1.log
alGetFloatv1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetListener3f1.log
alGetListener3f1(ILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V crashdump
crashlogs/alGetListener3i1.log
alGetListener3i1(ILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V crashdump
crashlogs/alGetListenerf1.log
alGetListenerf1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetListeneri1.log
alGetListeneri1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetListeneriv1.log
alGetListeneriv1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetProcAddress1.log
alGetProcAddress1(Ljava/lang/String;J)J crashdump
crashlogs/alGetProcAddressStatic.log
alGetProcAddressStatic(Ljava/lang/String;J)J crashdump
crashlogs/alGetSource3f1.log
alGetSource3f1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V crashdump
crashlogs/alGetSource3i1.log
alGetSource3i1(IILjava/lang/Object;IZLjava/lang/Object;IZLjava/lang/Object;IZJ)V crashdump
crashlogs/alGetSourcef1.log
alGetSourcef1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetSourcefv1.log
alGetSourcefv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetSourcei1.log
alGetSourcei1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetSourceiv1.log
alGetSourceiv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alGetString1.log
alGetString1(IJ)Ljava/lang/String; crashdump
crashlogs/alIsAuxiliaryEffectSlot1.log
alIsAuxiliaryEffectSlot1(IJ)Z crashdump
crashlogs/alIsBuffer1.log
alIsBuffer1(IJ)Z crashdump
crashlogs/alIsEffect1.log
alIsEffect1(IJ)Z crashdump
crashlogs/lIsExtensionPresent1.log
alIsExtensionPresent1(Ljava/lang/String;J)Z crashdump
crashlogs/alIsFilter1.log
alIsFilter1(IJ)Z crashdump
crashlogs/alListener3f1.log
alListener3f1(IFFFJ)V crashdump
crashlogs/alListener3i1.log
alListener3i1(IIIIJ)V crashdump
crashlogs/alListenerf1.log
alListenerf1(IFJ)V crashdump
crashlogs/alListenerfv1.log
alListenerfv1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alListeneri1.log
alListeneri1(IIJ)V crashdump
crashlogs/alListeneriv1.log
alListeneriv1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alSource3f1.log
alSource3f1(IIFFFJ)V crashdump
crashlogs/alSource3i1.log
alSource3i1(IIIIIJ)V crashdump
crashlogs/alSourcef1.log
alSourcef1(IIFJ)V crashdump
crashlogs/alSourcefv1.log
alSourcefv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alSourcei1.log
alSourcei1(IIIJ)V crashdump
crashlogs/alSourceiv1.log
alSourceiv1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alSourcePause1.log
alSourcePause1(IJ)V crashdump
crashlogs/alSourcePausev1.log
alSourcePausev1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alSourcePlay1.log
alSourcePlay1(IJ)V crashdump
crashlogs/alSourcePlayv1.log
alSourcePlayv1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alSourceQueueBuffers1.log
alSourceQueueBuffers1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alSourceRewindv1.log
alSourceRewindv1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alSourceStop1.log
alSourceStop1(IJ)V crashdump
crashlogs/alSourceStopv1.log
alSourceStopv1(ILjava/lang/Object;IZJ)V crashdump
crashlogs/alSourceUnqueueBuffers1.log
alSourceUnqueueBuffers1(IILjava/lang/Object;IZJ)V crashdump
crashlogs/alSpeedOfSound1.log
alSpeedOfSound1(FJ)V crashdump