58 lines
No EOL
1.9 KiB
Text
58 lines
No EOL
1.9 KiB
Text
#####################################################################################
|
|
|
|
Application: Oracle Outside-In JP2 File Parsing Heap Overflow
|
|
Version: The vulnerabilities are reported in versions 8.3.5 and 8.3.7.
|
|
Exploitation: Remote code execution
|
|
|
|
Secunia Number: SA49936
|
|
|
|
{PRL}: 2012-24
|
|
|
|
Author: Francis Provencher (Protek Research Lab's)
|
|
|
|
Website: http://www.protekresearchlab.com/
|
|
|
|
Twitter: @ProtekResearch
|
|
|
|
#####################################################################################
|
|
|
|
1) Introduction
|
|
2) Timeline
|
|
3) Technical details
|
|
4) PoC
|
|
|
|
|
|
#####################################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
Oracle Outside In Technology provides software developers with a comprehensive solution to access,
|
|
transform, and control the contents of over 500 unstructured file formats. From the latest office suites,
|
|
such as Microsoft Office 2007, to specialty formats and legacy files, Outside In Technology provides software
|
|
developers with the tools to transform unstructured files into controllable information.
|
|
#####################################################################################
|
|
|
|
============
|
|
2) Timeline
|
|
============
|
|
|
|
2012-05-03 - Vulnerability reported to secunia
|
|
2012-07-19 - Coordinated public release of advisory
|
|
|
|
#####################################################################################
|
|
|
|
=================
|
|
3) Technical details
|
|
=================
|
|
An error in the JP2 stream filter (vsjp2.dll) when copying the Quantization Default (QCD)
|
|
marker segment can be exploited to cause a heap-based buffer overflow via a specially
|
|
crafted JPEG2000 (JP2) file.
|
|
#####################################################################################
|
|
|
|
=============
|
|
4) The Code
|
|
=============
|
|
|
|
http://www.protekresearchlab.com/exploits/PRL-2012-24.jp2
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19962.jp2 |