[R1] HP LoadRunner Multiple Remote DoS

HP LoadRunner contains multiple flaws related to packet handling that can lead to a remote DoS, or one that could possibly lead to remote code execution, although that was not tested extensively.

#1: Multiple Service Connection Request xsr_string Field Handling NULL Pointer Dereference Remote DoS (HPSBGN03609 / CVE-2016-4361)

Affected: 11.52, 12.02. Not Affected: 12.50

Based on limited testing, since it appears to be fixed in the latest version, it is possible to trigger a NULL pointer dereference when sending the same packets to a combination of services based around magentservice.exe (the agent listens on multiple TCP ports including 54345, 50500, and 5003) and the xdr_string field in a connection request message. This was trivially reproduced by using Nessus with thorough_tests enabled, specifically the loadrunner_agent_detect.nasl, loadrunner_agent_service_ip_name_overflow.nasl, and hp_loadrunner_cve-2013-4800.nasl plugins.

(cd8.ccc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\HP\LoadRunner\launch_service\bin\launcher.dll - 
eax=00000000 ebx=01a51940 ecx=8184f62f edx=70011000 esi=01a51a58 edi=01a51a58
eip=6ccc91d8 esp=021de114 ebp=01a519e8 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
launcher!mxdr_p_lg_status_response_t+0x2ed5e:
6ccc91d8 8b00            mov     eax,dword ptr [eax]  ds:0023:00000000=????????

#2: Malformed Packet Handling Remote DoS (HPSBGN03609 / CVE-2016-4361)

Affected: 9.5. Not Affected: 10.50, 12.02

A malformed packet set to TCP port 5001 or TCP port 5002 causes the crash. As of version 12.02), the service no longer listens on those ports effectively 'fixing' the issue. This can be performed using Nessus with thorough_tests enabled. Since fixed in the latest version, further testing was not performed.

#3: mchan.dll Packet Handling Invalid Memory Access Remote DoS (HPSBGN03648 / CVE-2016-4384)

Affected: 11.52, 12.02, 12.50

By sending a specially crafted packet to the LoadRunner agent listening on TCP port 54345, a remote attacker can crash the service. A "-server_type=6" request (LinkList server) without a "ll_server_index=..." declaration in a connection request triggers the invalid memory access, possibly due to ll_server_index being uinitialized. This has not been fully tested to determine if remote code execution is possible.

(658.33c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=9b7e9a20 ebx=01e4dcf8 ecx=003f7558 edx=00000434 esi=fffffffd edi=003f7558
eip=6f2a8851 esp=01e4dc68 ebp=01e4dcf8 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
mchan!mchan_post_message+0x2605f:
6f2a8851 8b10            mov     edx,dword ptr [eax]  ds:0023:9b7e9a20=????????

A quick note on the CVE assignments. Once both HP advisories were out, we used them to determine that the CVE assignments were not ideal. Ultimately, CVE-2016-4361 (SSRT102274) should have represented all three issues in this advisory. However, when HPSBGN03648 was published with CVE-2016-4384, looking at the affected / fixed versions tells us that represents #3. So CVE-2016-4361 would actually cover #1 and #2 in this advisory. Here is the breakdown including our internal tracking numbers:

CVE-2016-4359 (PSRT110020, ZDI-CAN-3516 / ZDI-16-363) = TRA-13 = TRA-2016-16
CVE-2016-4360 (PSRT110032, ZDI-CAN-3555 / ZDI-16-364) = TRA-27 = TRA-2016-17
CVE-2016-4361 (SSRT102274) = TRA-14 #1 / #2 / #3 = TRA-2016-26
CVE-2016-4384 (PSRT110230) = TRA-14 #3  = TRA-2016-26

We are fairly confident that HP's internal records do not match this, but since we are the ones policing a CNA for not doing proper CVE assignments and us being involved with all of these disclosures, we are clearly stating the above to be the definitive CVE assignments.