Challenge Information - CROMU_00087

Commonly known as: Recipe_and_Pantry_Manager

Rounds Enabled

43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57

Details

Original Versions

Known Vulnerabilities

  • CWE-129 - Improper Validation of Array Index
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

Author Information

"John Berry" hj@cromulence.com

DARPA performer group

Cromulence

Description

The user can add and remove recipes as well as pantries containing ingredients.

Feature List

The main menu presents the user with the option to go into the Recipe, Pantry or Query menu.

The Recipe menu allows a user to add and remove recipes, list all or just a single recipe or print the cost of each recipe.

The Pantry menu allows a user to create and delete pantries, print all or just a single pantry or modify items in the grocery list.

The Query menu allows a user to select a pantry and print all recipes that can be made with items in that list. They can also query for recipes that they can make given an amount of money. Finally, they can print the cheapest and most expensive recipe.

Vulnerability

When printing an individual recipe the user is prompted to enter the index. This value is not validated and can be negative. Since each pantry structure has a 4 byte cookieand the array of pantries is stored at a lower address than the array of recipes, a user can provide a negative index to begin reading the data from the pantry structures.

There is some error checking done and the data that is read must be aligned properly so some setup of the pantry array is required to succeed.

Generic class of vulnerability

The CB fails to correcly validate the array index.

CWE classification

CWE-129: Improper Validation of Array Index

Challenges

Discovery: Locating the vulnerability is not too difficult. If the CRS can detect the bounds of the global recipe array using the usage of the bzero() function then they should be able to detect an out of bounds indexing.

PoV Generation: This is going to be relatively difficult because the chances of correctly creating pantries and then correctly indexing the recipe array in a way that passes the error checks is a little complex.

Patching: Once discovered, patching is a matter of changing the data to unsigned or correctly adding in bounds checks, neither of which are too difficult.

POV Information

Round Source Destination Result POV Analysis Video
44 CSDS CodeJitsu Failed POV POV Watch
44 CSDS DeepRed Failed POV POV Watch
44 CSDS Disekt Failed POV POV Watch
44 CSDS ForAllSecure Failed POV POV Watch
44 CSDS Shellphish Failed POV POV Watch
44 CSDS TECHx Failed POV POV Watch
44 DeepRed CodeJitsu Failed POV POV Watch
44 DeepRed CSDS Failed POV POV Watch
44 DeepRed Disekt Failed POV POV Watch
44 DeepRed ForAllSecure Failed POV POV Watch
44 DeepRed Shellphish Failed POV POV Watch
44 DeepRed TECHx Failed POV POV Watch
45 CSDS CodeJitsu Failed POV POV Watch
45 CSDS DeepRed Failed POV POV Watch
45 CSDS Disekt Failed POV POV Watch
45 CSDS ForAllSecure Failed POV POV Watch
45 CSDS Shellphish Failed POV POV Watch
45 CSDS TECHx Failed POV POV Watch
45 DeepRed CodeJitsu Failed POV POV Watch
45 DeepRed CSDS Failed POV POV Watch
45 DeepRed Disekt Failed POV POV Watch
45 DeepRed ForAllSecure Failed POV POV Watch
45 DeepRed Shellphish Failed POV POV Watch
45 DeepRed TECHx Failed POV POV Watch
46 CodeJitsu Disekt Failed POV through defenses POV Watch
46 CodeJitsu Shellphish Failed POV through defenses POV Watch
46 CSDS CodeJitsu Failed POV POV Watch
46 CSDS DeepRed Failed POV POV Watch
46 CSDS Disekt Failed POV through defenses POV Watch
46 CSDS ForAllSecure Failed POV POV Watch
46 CSDS Shellphish Failed POV through defenses POV Watch
46 CSDS TECHx Failed POV POV Watch
46 DeepRed CodeJitsu Failed POV POV Watch
46 DeepRed CSDS Failed POV POV Watch
46 DeepRed Disekt Failed POV through defenses POV Watch
46 DeepRed ForAllSecure Failed POV POV Watch
46 DeepRed Shellphish Failed POV through defenses POV Watch
46 DeepRed TECHx Failed POV POV Watch
47 CodeJitsu CSDS Failed POV through defenses POV Watch
47 CSDS CodeJitsu Failed POV through defenses POV Watch
47 CSDS DeepRed Failed POV POV Watch
47 CSDS Disekt Failed POV through defenses POV Watch
47 CSDS ForAllSecure Failed POV POV Watch
47 CSDS Shellphish Failed POV through defenses POV Watch
47 DeepRed CodeJitsu Failed POV through defenses POV Watch
47 DeepRed CSDS Failed POV through defenses POV Watch
47 DeepRed Disekt Failed POV through defenses POV Watch
47 DeepRed ForAllSecure Failed POV POV Watch
47 DeepRed Shellphish Failed POV through defenses POV Watch
48 CSDS CodeJitsu Failed POV through defenses POV Watch
48 CSDS DeepRed Failed POV POV Watch
48 CSDS Disekt Failed POV through defenses POV Watch
48 CSDS ForAllSecure Failed POV POV Watch
48 CSDS Shellphish Failed POV through defenses POV Watch
48 CSDS TECHx Failed POV through defenses POV Watch
48 DeepRed CodeJitsu Failed POV through defenses POV Watch
48 DeepRed CSDS Failed POV through defenses POV Watch
48 DeepRed Disekt Failed POV through defenses POV Watch
48 DeepRed ForAllSecure Failed POV POV Watch
48 DeepRed Shellphish Failed POV through defenses POV Watch
48 DeepRed TECHx Failed POV through defenses POV Watch
49 CSDS CodeJitsu Failed POV through defenses POV Watch
49 CSDS DeepRed Failed POV POV Watch
49 CSDS Disekt Failed POV through defenses POV Watch
49 CSDS ForAllSecure Failed POV POV Watch
49 CSDS Shellphish Failed POV through defenses POV Watch
49 CSDS TECHx Failed POV through defenses POV Watch
49 DeepRed CodeJitsu Failed POV through defenses POV Watch
49 DeepRed CSDS Failed POV through defenses POV Watch
49 DeepRed Disekt Failed POV through defenses POV Watch
49 DeepRed ForAllSecure Failed POV POV Watch
49 DeepRed Shellphish Failed POV through defenses POV Watch
49 DeepRed TECHx Failed POV through defenses POV Watch
50 CSDS CodeJitsu Failed POV through defenses POV Watch
50 CSDS DeepRed Failed POV POV Watch
50 CSDS Disekt Failed POV through defenses POV Watch
50 CSDS ForAllSecure Failed POV POV Watch
50 CSDS Shellphish Failed POV through defenses POV Watch
50 CSDS TECHx Failed POV through defenses POV Watch
50 DeepRed CodeJitsu Failed POV through defenses POV Watch
50 DeepRed CSDS Failed POV through defenses POV Watch
50 DeepRed Disekt Failed POV through defenses POV Watch
50 DeepRed ForAllSecure Failed POV POV Watch
50 DeepRed Shellphish Failed POV through defenses POV Watch
50 DeepRed TECHx Failed POV through defenses POV Watch
51 CSDS CodeJitsu Failed POV through defenses POV Watch
51 CSDS DeepRed Failed POV POV Watch
51 CSDS Disekt Failed POV through defenses POV Watch
51 CSDS ForAllSecure Failed POV POV Watch
51 CSDS Shellphish Failed POV through defenses POV Watch
51 CSDS TECHx Failed POV through defenses POV Watch
51 DeepRed CodeJitsu Failed POV through defenses POV Watch
51 DeepRed CSDS Failed POV through defenses POV Watch
51 DeepRed Disekt Failed POV through defenses POV Watch
51 DeepRed ForAllSecure Failed POV POV Watch
51 DeepRed Shellphish Failed POV through defenses POV Watch
51 DeepRed TECHx Failed POV through defenses POV Watch
52 CSDS CodeJitsu Failed POV through defenses POV Watch
52 CSDS DeepRed Failed POV POV Watch
52 CSDS Disekt Failed POV through defenses POV Watch
52 CSDS ForAllSecure Failed POV POV Watch
52 CSDS Shellphish Failed POV through defenses POV Watch
52 CSDS TECHx Failed POV through defenses POV Watch
52 DeepRed CodeJitsu Failed POV through defenses POV Watch
52 DeepRed CSDS Failed POV through defenses POV Watch
52 DeepRed Disekt Failed POV through defenses POV Watch
52 DeepRed ForAllSecure Failed POV POV Watch
52 DeepRed Shellphish Failed POV through defenses POV Watch
52 DeepRed TECHx Failed POV through defenses POV Watch
53 CSDS CodeJitsu Failed POV through defenses POV Watch
53 CSDS DeepRed Failed POV POV Watch
53 CSDS Disekt Failed POV through defenses POV Watch
53 CSDS ForAllSecure Failed POV POV Watch
53 CSDS Shellphish Failed POV through defenses POV Watch
53 CSDS TECHx Failed POV through defenses POV Watch
53 DeepRed CodeJitsu Failed POV through defenses POV Watch
53 DeepRed CSDS Failed POV through defenses POV Watch
53 DeepRed Disekt Failed POV through defenses POV Watch
53 DeepRed ForAllSecure Failed POV POV Watch
53 DeepRed Shellphish Failed POV through defenses POV Watch
53 DeepRed TECHx Failed POV through defenses POV Watch
54 CSDS CodeJitsu Failed POV through defenses POV Watch
54 CSDS DeepRed Failed POV POV Watch
54 CSDS Disekt Failed POV through defenses POV Watch
54 CSDS ForAllSecure Failed POV POV Watch
54 CSDS Shellphish Failed POV through defenses POV Watch
54 CSDS TECHx Failed POV through defenses POV Watch
54 DeepRed CodeJitsu Failed POV through defenses POV Watch
54 DeepRed CSDS Failed POV through defenses POV Watch
54 DeepRed Disekt Failed POV through defenses POV Watch
54 DeepRed ForAllSecure Failed POV POV Watch
54 DeepRed Shellphish Failed POV through defenses POV Watch
54 DeepRed TECHx Failed POV through defenses POV Watch
55 CSDS CodeJitsu Failed POV through defenses POV Watch
55 CSDS DeepRed Failed POV POV Watch
55 CSDS Disekt Failed POV through defenses POV Watch
55 CSDS ForAllSecure Failed POV POV Watch
55 CSDS Shellphish Failed POV through defenses POV Watch
55 CSDS TECHx Failed POV through defenses POV Watch
55 DeepRed CodeJitsu Failed POV through defenses POV Watch
55 DeepRed CSDS Failed POV through defenses POV Watch
55 DeepRed Disekt Failed POV through defenses POV Watch
55 DeepRed ForAllSecure Failed POV POV Watch
55 DeepRed Shellphish Failed POV through defenses POV Watch
55 DeepRed TECHx Failed POV through defenses POV Watch
56 DeepRed CodeJitsu Failed POV through defenses POV Watch
56 DeepRed CSDS Failed POV through defenses POV Watch
56 DeepRed Disekt Failed POV through defenses POV Watch
56 DeepRed ForAllSecure Failed POV POV Watch
56 DeepRed Shellphish Failed POV through defenses POV Watch
56 DeepRed TECHx Failed POV through defenses POV Watch
57 CSDS CodeJitsu Failed POV through defenses POV Watch
57 CSDS DeepRed Failed POV POV Watch
57 CSDS Disekt Failed POV through defenses POV Watch
57 CSDS ForAllSecure Failed POV POV Watch
57 CSDS Shellphish Failed POV through defenses POV Watch
57 CSDS TECHx Failed POV through defenses POV Watch
57 DeepRed CodeJitsu Failed POV through defenses POV Watch
57 DeepRed CSDS Failed POV through defenses POV Watch
57 DeepRed Disekt Failed POV through defenses POV Watch
57 DeepRed ForAllSecure Failed POV POV Watch
57 DeepRed Shellphish Failed POV through defenses POV Watch
57 DeepRed TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email