188 lines
No EOL
5.8 KiB
Text
188 lines
No EOL
5.8 KiB
Text
Core Security - Corelabs Advisory
|
|
http://corelabs.coresecurity.com/
|
|
|
|
XnView Buffer Overflow Vulnerability
|
|
|
|
|
|
1. *Advisory Information*
|
|
|
|
Title: XnView Buffer Overflow Vulnerability
|
|
Advisory ID: CORE-2013-0705
|
|
Advisory URL:
|
|
http://www.coresecurity.com/advisories/xnview-buffer-overflow-vulnerability
|
|
Date published: 2013-07-22
|
|
Date of last update: 2013-07-22
|
|
Vendors contacted: XnView
|
|
Release mode: Coordinated release
|
|
|
|
|
|
2. *Vulnerability Information*
|
|
|
|
Class: Buffer overflow [CWE-119]
|
|
Impact: Code execution
|
|
Remotely Exploitable: Yes
|
|
Locally Exploitable: No
|
|
CVE Name: CVE-2013-2577
|
|
|
|
|
|
3. *Vulnerability Description*
|
|
|
|
XnView [1], [2] is prone to a security vulnerability when processing PCT
|
|
files. This vulnerability could be exploited by a remote attacker to
|
|
execute arbitrary code on the target machine, by enticing the user of
|
|
XnView to open a specially crafted file.
|
|
|
|
|
|
4. *Vulnerable Packages*
|
|
|
|
. XnView v2.03 for Windows.
|
|
. Older versions are probably affected too, but they were not checked.
|
|
|
|
|
|
5. *Non-Vulnerable Packages*
|
|
|
|
. XnView v2.04.
|
|
|
|
|
|
6. *Credits*
|
|
|
|
This vulnerability was discovered and researched by Ricardo Narvaja from
|
|
Core Exploit Writers Team. The publication of this advisory was
|
|
coordinated by Fernando Miranda from Core Advisories Team.
|
|
|
|
|
|
7. *Technical Description / Proof of Concept Code*
|
|
|
|
Below is shown the result of opening the maliciously crafted file
|
|
'CORE-2013-0705-xnview-poc-4895a357a242d3c78.PCT'[3]:
|
|
|
|
/-----
|
|
7C9108F3 8902 MOV DWORD PTR DS:[EDX],EAX
|
|
7C9108F5 8941 04 MOV DWORD PTR DS:[ECX+4],EAX
|
|
7C9108F8 56 PUSH ESI
|
|
7C9108F9 8B75 C8 MOV ESI,DWORD PTR SS:[EBP-38]
|
|
7C9108FC 56 PUSH ESI
|
|
7C9108FD E8 BAFDFFFF CALL ntdll.7C9106BC << CRASH
|
|
|
|
EAX 00EC3008
|
|
ECX 003C95B0
|
|
EDX 41424344
|
|
EBX 003C0178
|
|
ESP 0013E708
|
|
EBP 0013E7C4
|
|
ESI 00EC3000
|
|
EDI 003C0000
|
|
EIP 7C9108F3 ntdll.7C9108F3
|
|
C 1 ES 0023 32bit 0(FFFFFFFF)
|
|
P 0 CS 001B 32bit 0(FFFFFFFF)
|
|
A 1 SS 0023 32bit 0(FFFFFFFF)
|
|
Z 0 DS 0023 32bit 0(FFFFFFFF)
|
|
S 1 FS 003B 32bit 7FFDF000(FFF)
|
|
T 0 GS 0000 NULL
|
|
D 0
|
|
O 0 LastErr ERROR_NO_SCROLLBARS (000005A7)
|
|
EFL 00010293 (NO,B,NE,BE,S,PO,L,LE)
|
|
ST0 empty +UNORM 043E 7C910435 0007DC88
|
|
ST1 empty +UNORM 0002 0007DB84 00020024
|
|
ST2 empty -UNORM DA40 7C901000 7FFDE000
|
|
ST3 empty +UNORM 0460 7C90E920 0007DB14
|
|
ST4 empty +UNORM 0208 7C913F85 7C913F92
|
|
ST5 empty +UNORM 0044 77DDE250 0007DE54
|
|
ST6 empty 0.0000000000000006002
|
|
ST7 empty 0.0000000000000006002
|
|
3 2 1 0 E S P U O Z D I
|
|
FST 4020 Cond 1 0 0 0 Err 0 0 1 0 0 0 0 0 (EQ)
|
|
FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1
|
|
|
|
-----/
|
|
|
|
As a result, the address 0x41424344 (controlled by the attacker) can be
|
|
overwritten and the normal execution flow can be altered in order to
|
|
execute arbitrary code.
|
|
|
|
/-----
|
|
003C95B0 32 32 33 34 44 43 42 41 AA AA AA AA 34 35 36 37 2234DCBAªªªª4567
|
|
003C95C0 38 90 91 26 32 32 26 3C 36 32 36 36 32 36 3C 3C 8??&22&<626626<<
|
|
003C95D0 54 65 6D 73 82 82 87 90 90 99 9A 9B 9E A1 A6 AA Tems?????????¡¦ª
|
|
003C95E0 AE AF B3 B5 B5 B6 BB BC BD BD BE BF C1 C3 C7 CB ®¯³µµ¶»¼½½¾¿ÁÃÇË
|
|
-----/
|
|
|
|
|
|
8. *Report Timeline*
|
|
. 2013-07-04:
|
|
Core Security Technologies notifies the XnView team of the
|
|
vulnerability. Publication date is set for July 31st, 2013.
|
|
|
|
. 2013-07-09:
|
|
Vendor asks for a report with technical information.
|
|
|
|
. 2013-07-10:
|
|
Technical details sent to XnView team.
|
|
|
|
. 2013-07-11:
|
|
Vendor notifies that the issue will be fixed in the next product release.
|
|
|
|
. 2013-07-15:
|
|
Core asks when the next release has been scheduled.
|
|
|
|
. 2013-07-16:
|
|
Vendor notifies that the next product release is scheduled for next week.
|
|
|
|
. 2013-07-17:
|
|
Core re-schedules the advisory publication for Monday 22nd.
|
|
|
|
. 2013-07-22:
|
|
Advisory CORE-2013-0705 released.
|
|
|
|
|
|
9. *References*
|
|
|
|
[1] http://www.xnview.com/.
|
|
[2] http://www.xnview.com/en/xnview/.
|
|
[3]
|
|
http://www.coresecurity.com/system/files/attachments/2013/07/CORE-2013-0705-xnview-poc-4895a357a242d3c78.zip
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27049.zip
|
|
|
|
10. *About CoreLabs*
|
|
|
|
CoreLabs, the research center of Core Security Technologies, is charged
|
|
with anticipating the future needs and requirements for information
|
|
security technologies. We conduct our research in several important
|
|
areas of computer security including system vulnerabilities, cyber
|
|
attack planning and simulation, source code auditing, and cryptography.
|
|
Our results include problem formalization, identification of
|
|
vulnerabilities, novel solutions and prototypes for new technologies.
|
|
CoreLabs regularly publishes security advisories, technical papers,
|
|
project information and shared software tools for public use at:
|
|
http://corelabs.coresecurity.com.
|
|
|
|
|
|
11. *About Core Security Technologies*
|
|
|
|
Core Security Technologies enables organizations to get ahead of threats
|
|
with security test and measurement solutions that continuously identify
|
|
and demonstrate real-world exposures to their most critical assets. Our
|
|
customers can gain real visibility into their security standing, real
|
|
validation of their security controls, and real metrics to more
|
|
effectively secure their organizations.
|
|
|
|
Core Security's software solutions build on over a decade of trusted
|
|
research and leading-edge threat expertise from the company's Security
|
|
Consulting Services, CoreLabs and Engineering groups. Core Security
|
|
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
|
|
http://www.coresecurity.com.
|
|
|
|
|
|
12. *Disclaimer*
|
|
|
|
The contents of this advisory are copyright (c) 2013 Core Security
|
|
Technologies and (c) 2013 CoreLabs, and are licensed under a Creative
|
|
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
|
|
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
|
|
|
|
|
|
13. *PGP/GPG Keys*
|
|
|
|
This advisory has been signed with the GPG key of Core Security
|
|
Technologies advisories team, which is available for download at
|
|
http://www.coresecurity.com/files/attachments/core_security_advisories.asc. |