Posts Tagged ‘ overflow

NCH Software Express Burn Plus 4.68 EBP Project File Handling Buffer Overflow PoC

The vulnerability is caused due to a boundary error in the processing of a project file, which can be exploited to cause a unicode buffer overflow when a user opens e.g. a specially crafted .EBP file. Successful exploitation could allow execution of arbitrary code on the affected machine.

eburn2bof

eburn2bof2

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5166.php

Ref: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5103.php

TeraCopy 2.3 (default.mo) Language File Integer Overflow Vulnerability

TeraCopy is prone to an integer overflow vulnerability because it fails to perform adequate boundary checks when reading language files. Successfully exploiting this issue may allow local attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions.

teracopy

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5155.php

SAS Integration Technologies Client 9.31_M1 (SASspk.dll) Stack-based Overflow

SAS Integration Technologies provides you with software that enables you to build a secure client/server infrastructure on which to implement SAS distributed processing solutions. With SAS Integration Technologies, you can integrate SAS with other applications in your enterprise; provide proactive delivery of information from SAS throughout the enterprise; extend the capabilities of SAS to meet your organization’s specific needs; and develop your own distributed applications that leverage the analytic and reporting powers of SAS. The SAS Deployment Manager is used for post-installation configuration tasks such as configuring some products, applying hot fixes, updating metadata, and uninstalling SAS software.

The SASspk module (SASspk.dll) version 9.310.0.11307, has a function called ‘RetrieveBinaryFile()’ which has one parameter called ‘bstrFileName’ which takes arguments as strings as defined in the function itself as ISPKBinaryFile from the SASPackageRetrieve library. Stack-based buffer overflow was discovered in one of the fuzzing processes that could allow arbitrary code execution by an attacker when exploiting the non-sanitized ‘bstrFileName’ parameter.

SAS Stack-based Buffer Overflow Vulnerability

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5142.php
Vendor: http://support.sas.com/kb/49/961.html

Sony PC Companion Multiple Stack-based Buffer Overflow Vulnerabilities

The vulnerabilities are caused due to a boundary error in several .dll libraries when handling the value assigned to different functions and can be exploited to cause a stack-based buffer overflow via an overly long string which may lead to execution of arbitrary code on the affected machine.

sehchain-sonypc-immdbg

sonypc_immdbg

sonypccuploadmgr

sonyresearch

Advisories:

Sony PC Companion 2.1 (Admin_RemoveDirectory()) Stack-based Unicode Buffer Overload
Sony PC Companion 2.1 (CheckCompatibility()) Stack-based Unicode Buffer Overload
Sony PC Companion 2.1 (Load()) Stack-based Unicode Buffer Overload SEH
Sony PC Companion 2.1 (DownloadURLToFile()) Stack-based Unicode Buffer Overload SEH

t00t

NVIDIA Install Application 2.1002.85.551 (NVI2.dll) Unicode Buffer Overflow PoC

The vulnerability is caused due to a boundary error in NVI2.DLL when handling the value assigned to the ‘pDirectory’ string variable in the ‘AddPackages’ function and can be exploited to cause a unicode buffer overflow by inserting an overly long array of data which may lead to execution of arbitrary code.
-Null pointer read-

There are more bugs in this driver package, several affecting kernelbase.dll.

Advisory ID: ZSL-2012-5116
Link: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5116.php

Express Burn Plus v4.58 EBP Project File Handling Buffer Overflow PoC

The vulnerability is caused due to a boundary error in the processing of a project file, which can be exploited to cause a unicode buffer overflow when a user opens e.g. a specially crafted .EBP file. Successful exploitation could allow execution of arbitrary code on the affected machine.

——————————————————————————–
(13d4.a84): Access violation – code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=050a8c70 ebx=004034fc ecx=00000041 edx=fc4d5390 esi=0157cf68 edi=001297fe
eip=004678ef esp=00126420 ebp=001274c0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
*** WARNING: Unable to verify checksum for image00400000
*** ERROR: Module load completed but symbols could not be loaded for image00400000
image00400000+0x678ef:
004678ef 66890c02 mov word ptr [edx+eax],cx ds:0023:0157e000=????
0:000> d eax
050a8c70 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8c80 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8c90 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8ca0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8cb0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8cc0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8cd0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
050a8ce0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0:000> d esi
0157cf68 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cf78 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cf88 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cf98 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cfa8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cfb8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cfc8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0157cfd8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.

———————————————————————————-

Advisory ID: ZSL-2012-5103
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5103.php

Apple iTunes 10.6.1.7 M3U Playlist File Walking Heap Buffer Overflow

The vulnerability is caused due to a boundary error in the processing of a playlist file, which can be exploited to cause a heap based buffer overflow when a user opens e.g. a specially crafted .M3U file. Successful exploitation could allow execution of arbitrary code on the affected node.

 

Apple: http://support.apple.com/kb/HT5318
ZSL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5093.php

TXT: http://www.zeroscience.mk/codes/itunes_bof.txt

Themida and WinLicense Vulnerabilities

The vulnerability in Themida is caused due to a boundary error in the processing of a project file, which can be exploited to cause a buffer overflow when a user opens e.g. a specially crafted .TMD file. Successful exploitation may allow execution of arbitrary code.

WinLicense is prone to an unspecified memory corruption vulnerability. An attacker can exploit this issue by tricking a victim into opening a malicious XML file to execute arbitrary code and to cause denial-of-service conditions.

Advisories:

ZSL-2012-5079http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5079.php
ZSL-2012-5080http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5080.php

EdrawSoft Office Viewer Component ActiveX 5.6 (officeviewermme.ocx) BoF PoC

The ActiveX suffers from a buffer overflow vulnerability when parsing large amount of bytes to the FtpUploadFile member in FtpUploadFile() function, resulting memory corruption overwriting severeal registers including the SEH. An attacker can gain access to the system of the affected node and execute arbitrary code.

--------------------------------------------------------------

CompanyName EdrawSoft
FileDescription Edraw Office Viewer Component
FileVersion 5.6.578.1

OriginalFileName officeviewer.ocx
ProductName OfficeViewerOCX
ProductVersion 5.6.5781

Report for Clsid: {F6FE8878-54D2-4333-B9F0-FC543B1BE1ED}
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: True
IDisp Safe: Safe for untrusted: caller,data
IPStorage Safe: Safe for untrusted: caller,data

Exception Code: ACCESS_VIOLATION
Disasm: 220324CC MOV [EDI],AX (officeviewermme.ocx)

Seh Chain:
--------------------------------------------------
1 410041

Called From Returns To
--------------------------------------------------
officeviewermme.220324CC officeviewermme.22026402

Registers:
--------------------------------------------------
EIP 220324CC
EAX 00000041
EBX 00001015
ECX 000002A0
EDX 001B2E4C -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EDI 01870000
ESI 0186E518 -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP 0186C490 -> 0186C530
ESP 0186C488 -> 00000000

Block Disassembly:
--------------------------------------------------
220324BD MOV EDI,[EBP+8]
220324C0 MOV ESI,EDI
220324C2 TEST ECX,ECX
220324C4 JE SHORT 220324F7
220324C6 MOV EDX,[EBP+C]
220324C9 MOVZX EAX,WORD PTR [EDX]
220324CC MOV [EDI],AX <--- CRASH
220324CF INC EDI
220324D0 INC EDI
220324D1 INC EDX
220324D2 INC EDX
220324D3 TEST AX,AX
220324D6 JE SHORT 220324DB
220324D8 DEC ECX
220324D9 JNZ SHORT 220324C9

ArgDump:
--------------------------------------------------
EBP+8 0186E518 -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+12 001B1364 -> Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+16 00001014
EBP+20 00000000
EBP+24 000007FC
EBP+28 01761EC0 -> Uni: D5")"

Stack Dump:
--------------------------------------------------
186C488 00 00 00 00 64 13 1B 00 30 C5 86 01 02 64 02 22 [....d........d..]
186C498 18 E5 86 01 64 13 1B 00 14 10 00 00 00 00 00 00 [....d...........]
186C4A8 FC 07 00 00 C0 1E 76 01 18 CD 86 01 18 D5 86 01 [......v.........]
186C4B8 18 ED 86 01 64 13 1B 00 10 CD 86 01 18 E5 86 01 [....d...........]
186C4C8 14 10 00 00 8E 33 1B 00 14 10 00 00 00 00 00 00 [................]

--------------------------------------------------------------

(6c9c.6c70): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000041 ebx=00001015 ecx=000002a0 edx=001b2edc esi=0186e518 edi=01870000
eip=220324cc esp=0186c488 ebp=0186c490 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Mindjet\MindManager 10\officeviewermme.ocx -
officeviewermme!DllRegisterServer+0x23bbe:
220324cc 668907 mov word ptr [edi],ax ds:0023:01870000=????
0:004> !exchain
0186fa84: 00410041
Invalid exception stack at 00410041
0:004> d esi
0186e518 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e528 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e538 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e548 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e558 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e568 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e578 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186e588 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0:004> d edx
001b2edc 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2eec 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2efc 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2f0c 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2f1c 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2f2c 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2f3c 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
001b2f4c 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0:004> d esp+3000
0186f488 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f498 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4a8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4b8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4c8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4d8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4e8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0186f4f8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
0:004> !load msec; !exploitable
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at officeviewermme!DllRegisterServer+0x0000000000023bbe (Hash=0x55146322.0x550a2c22)

User mode write access violations that are not near NULL are exploitable.

Advisory ID: ZSL-2012-5069
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5069.php

Tracker Software pdfSaver ActiveX 3.60 (pdfxctrl.dll) Stack Buffer Overflow (SEH)

The PDF Printer Preferences ActiveX suffers from a buffer overflow vulnerability. When a large buffer is sent to the sub_path item of the StoreInRegistry function, and the sub_key item of the InitFromRegistry function, in pdfxctrl.dll module, we get a SEH overwrite. An attacker can gain access to the system of the affected node and execute arbitrary code.

Discovered on 25.01.2012 included in Mindjet MindManager 2012 for Windows version 10.0.493.

COMRaider Output:

-----------
Exception Code: ACCESS_VIOLATION
Disasm: 7C834D8F REP MOVS DWORD PTR ES:[EDI],DWORD PTR [ESI] (KERNEL32.dll)

Seh Chain:
--------------------------------------------------
1 7C839AC0 KERNEL32.dll
2 41414141

Called From Returns To
--------------------------------------------------
KERNEL32.7C834D8F pdfxctrl.1001D8E7
pdfxctrl.1001D8E7 41414141

Registers:
--------------------------------------------------
EIP 7C834D8F -> Asc: SOFTWARE\Tracker Software\pdf
EAX 0013E9E0 -> Asc: SOFTWARE\Tracker Software\pdf
EBX 00000003
ECX 0000008C
EDX 00001815
EDI 0013FFFD -> 41000000
ESI 0013CD74 -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EBP 0013B780 -> 0013EDE4
ESP 0013B75C -> 0000302A -> Uni: *0*0

Block Disassembly:
--------------------------------------------------
7C834D82 MOV CL,[EDI+1]
7C834D85 INC EDI
7C834D86 TEST CL,CL
7C834D88 JNZ SHORT 7C834D82
7C834D8A MOV ECX,EDX
7C834D8C SHR ECX,2
7C834D8F REP MOVS DWORD PTR ES:[EDI],DWORD PTR [ESI] <--- CRASH
7C834D91 MOV ECX,EDX
7C834D93 AND ECX,3
7C834D96 REP MOVS BYTE PTR ES:[EDI],BYTE PTR [ESI]
7C834D98 OR DWORD PTR [EBP-4],FFFFFFFF
7C834D9C CALL 7C802511
7C834DA1 RETN 8
7C834DA4 NOP
7C834DA5 NOP

ArgDump:
--------------------------------------------------
EBP+8 0013E9E0 -> Asc: SOFTWARE\Tracker Software\pdf
EBP+12 0013B790 -> Asc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EBP+16 41414141
EBP+20 41414141
EBP+24 41414141
EBP+28 41414141

Stack Dump:
--------------------------------------------------
13B75C 2A 30 00 00 84 63 18 00 03 00 00 00 5C B7 13 00 [.....c......\...]
13B76C 2A 30 00 00 AC F1 13 00 C0 9A 83 7C A8 4D 83 7C [.............M..]
13B77C 00 00 00 00 E4 ED 13 00 E7 D8 01 10 E0 E9 13 00 [................]
13B78C 90 B7 13 00 41 41 41 41 41 41 41 41 41 41 41 41 [................]
13B79C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [................]

-----------

CompanyName Tracker Software Products
FileDescription PDF Printer Preferences ActiveX
FileVersion 3.60.0128
InternalName pdfxctrl.dll
LegalCopyright Copyright © 2001-2006 by Tracker Software Products
OriginalFileName pdfxctrl.dll
ProductName Tracker Software Products pdfxctrl.PdfPrinterPreferences ActiveX
ProductVersion 3.60

Advisory ID: ZSL-2012-5067 (Tracker Software pdfSaver ActiveX 3.60 (pdfxctrl.dll) Stack Buffer Overflow (SEH))
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5067.php