OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
[Full-disclosure] Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-4089

From: Rodrigo Branco (rbrancocheckpoint.com)
Date: Sat Oct 30 2010 - 10:14:24 CDT


Dear List,

I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability.

Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/

Memory corruption when Adobe Shockwave Player parses .dir media file (duplicated LCSM entries in mmap record)
CVE-2010-4089

INTRODUCTION

Adobe Shockwave Player is the Adobe plugin to many different browsers to view rich-media content on the web including animations, interactive presentations, and online entertainment.

Adobe Shockwave Player does not properly parse .dir media file. mmap records contains offsets and lengths of all other records. One of such records is LCSM. It also contains references to other records. Duplicated LCSM entries causes memory corruption as shown in PoC (repro15.dir).

This problem was confirmed in the following versions of Adobe Shockwave Player and Windows, other versions may be also affected.

Shockwave Player version 11.5.8.612, Module IML32.dll on WinXP_PT SP3 Internet Explorer 8.0.6001.18702

CVSS Scoring System

The CVSS score is: 9
        Base Score: 10
        Temporal Score: 9
We used the following values to calculate the scores:
        Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C
        Temporal score is: E:POC/RL:U/RC:C

TRIGGERING THE PROBLEM

To trigger the problem a PoC file (repro15.dir) is available to interested parties.

DETAILS

ModLoad: 03a20000 03a27000 C:\WINDOWS\system32\Adobe\Shockwave 11\xtras\CBrowser.x32
ModLoad: 03e10000 03e27000 C:\Documents and Settings\Rodrigo\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\TextAsset\Text Asset.x32
ModLoad: 048a0000 04989000 C:\Documents and Settings\Rodrigo\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\TextXtra\TextXtra.x32
ModLoad: 04430000 04475000 C:\Documents and Settings\Rodrigo\Application Data\Adobe\Shockwave Player 11\xtras\download\AdobeSystemsIncorporated\FontXtra\Font Xtra.x32
(1cc.b74): Access violation - code c0000005 (!!! second chance !!!)
eax=00000068 ebx=00000020 ecx=0162d550 edx=00000068 esi=0162d550 edi=0543386c
eip=69009f1f esp=0162d540 ebp=0543386c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
*** WARNING: Unable to verify checksum for C:\WINDOWS\system32\Adobe\Shockwave 11\IML32.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\Adobe\Shockwave 11\IML32.dll -
IML32!Ordinal1113+0xf:
69009f1f 8b4804 mov ecx,dword ptr [eax+4] ds:0023:0000006c=????????
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.
0:008> !exploitable
Exploitability Classification: UNKNOWN
Recommended Bug Title: Data from Faulting Address controls Branch Selection starting at IML32!Ordinal1113+0x000000000000000f (Hash=0x1a537c3d.0x1a63313d)

The data from the faulting address is later used to determine whether or not a branch is taken.

Exploitation details sent to Adobe.

CREDITS

This vulnerability was discovered by Michael Golub and researched by Rodrigo Rubira Branco from Check Point Vulnerability Discovery Team (VDT).

Best Regards,
 
Rodrigo.
 
--
Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/