ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
188 lines
No EOL
6 KiB
Text
188 lines
No EOL
6 KiB
Text
Core Security - Corelabs Advisory
|
|
http://corelabs.coresecurity.com/
|
|
|
|
XnView Buffer Overflow Vulnerability
|
|
|
|
|
|
1. *Advisory Information*
|
|
|
|
Title: XnView Buffer Overflow Vulnerability
|
|
Advisory ID: CORE-2013-0705
|
|
Advisory URL:
|
|
http://www.coresecurity.com/advisories/xnview-buffer-overflow-vulnerability
|
|
Date published: 2013-07-22
|
|
Date of last update: 2013-07-22
|
|
Vendors contacted: XnView
|
|
Release mode: Coordinated release
|
|
|
|
|
|
2. *Vulnerability Information*
|
|
|
|
Class: Buffer overflow [CWE-119]
|
|
Impact: Code execution
|
|
Remotely Exploitable: Yes
|
|
Locally Exploitable: No
|
|
CVE Name: CVE-2013-2577
|
|
|
|
|
|
3. *Vulnerability Description*
|
|
|
|
XnView [1], [2] is prone to a security vulnerability when processing PCT
|
|
files. This vulnerability could be exploited by a remote attacker to
|
|
execute arbitrary code on the target machine, by enticing the user of
|
|
XnView to open a specially crafted file.
|
|
|
|
|
|
4. *Vulnerable Packages*
|
|
|
|
. XnView v2.03 for Windows.
|
|
. Older versions are probably affected too, but they were not checked.
|
|
|
|
|
|
5. *Non-Vulnerable Packages*
|
|
|
|
. XnView v2.04.
|
|
|
|
|
|
6. *Credits*
|
|
|
|
This vulnerability was discovered and researched by Ricardo Narvaja from
|
|
Core Exploit Writers Team. The publication of this advisory was
|
|
coordinated by Fernando Miranda from Core Advisories Team.
|
|
|
|
|
|
7. *Technical Description / Proof of Concept Code*
|
|
|
|
Below is shown the result of opening the maliciously crafted file
|
|
'CORE-2013-0705-xnview-poc-4895a357a242d3c78.PCT'[3]:
|
|
|
|
/-----
|
|
7C9108F3 8902 MOV DWORD PTR DS:[EDX],EAX
|
|
7C9108F5 8941 04 MOV DWORD PTR DS:[ECX+4],EAX
|
|
7C9108F8 56 PUSH ESI
|
|
7C9108F9 8B75 C8 MOV ESI,DWORD PTR SS:[EBP-38]
|
|
7C9108FC 56 PUSH ESI
|
|
7C9108FD E8 BAFDFFFF CALL ntdll.7C9106BC << CRASH
|
|
|
|
EAX 00EC3008
|
|
ECX 003C95B0
|
|
EDX 41424344
|
|
EBX 003C0178
|
|
ESP 0013E708
|
|
EBP 0013E7C4
|
|
ESI 00EC3000
|
|
EDI 003C0000
|
|
EIP 7C9108F3 ntdll.7C9108F3
|
|
C 1 ES 0023 32bit 0(FFFFFFFF)
|
|
P 0 CS 001B 32bit 0(FFFFFFFF)
|
|
A 1 SS 0023 32bit 0(FFFFFFFF)
|
|
Z 0 DS 0023 32bit 0(FFFFFFFF)
|
|
S 1 FS 003B 32bit 7FFDF000(FFF)
|
|
T 0 GS 0000 NULL
|
|
D 0
|
|
O 0 LastErr ERROR_NO_SCROLLBARS (000005A7)
|
|
EFL 00010293 (NO,B,NE,BE,S,PO,L,LE)
|
|
ST0 empty +UNORM 043E 7C910435 0007DC88
|
|
ST1 empty +UNORM 0002 0007DB84 00020024
|
|
ST2 empty -UNORM DA40 7C901000 7FFDE000
|
|
ST3 empty +UNORM 0460 7C90E920 0007DB14
|
|
ST4 empty +UNORM 0208 7C913F85 7C913F92
|
|
ST5 empty +UNORM 0044 77DDE250 0007DE54
|
|
ST6 empty 0.0000000000000006002
|
|
ST7 empty 0.0000000000000006002
|
|
3 2 1 0 E S P U O Z D I
|
|
FST 4020 Cond 1 0 0 0 Err 0 0 1 0 0 0 0 0 (EQ)
|
|
FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1
|
|
|
|
-----/
|
|
|
|
As a result, the address 0x41424344 (controlled by the attacker) can be
|
|
overwritten and the normal execution flow can be altered in order to
|
|
execute arbitrary code.
|
|
|
|
/-----
|
|
003C95B0 32 32 33 34 44 43 42 41 AA AA AA AA 34 35 36 37 2234DCBAªªªª4567
|
|
003C95C0 38 90 91 26 32 32 26 3C 36 32 36 36 32 36 3C 3C 8??&22&<626626<<
|
|
003C95D0 54 65 6D 73 82 82 87 90 90 99 9A 9B 9E A1 A6 AA Tems?????????¡¦ª
|
|
003C95E0 AE AF B3 B5 B5 B6 BB BC BD BD BE BF C1 C3 C7 CB ®¯³µµ¶»¼½½¾¿ÁÃÇË
|
|
-----/
|
|
|
|
|
|
8. *Report Timeline*
|
|
. 2013-07-04:
|
|
Core Security Technologies notifies the XnView team of the
|
|
vulnerability. Publication date is set for July 31st, 2013.
|
|
|
|
. 2013-07-09:
|
|
Vendor asks for a report with technical information.
|
|
|
|
. 2013-07-10:
|
|
Technical details sent to XnView team.
|
|
|
|
. 2013-07-11:
|
|
Vendor notifies that the issue will be fixed in the next product release.
|
|
|
|
. 2013-07-15:
|
|
Core asks when the next release has been scheduled.
|
|
|
|
. 2013-07-16:
|
|
Vendor notifies that the next product release is scheduled for next week.
|
|
|
|
. 2013-07-17:
|
|
Core re-schedules the advisory publication for Monday 22nd.
|
|
|
|
. 2013-07-22:
|
|
Advisory CORE-2013-0705 released.
|
|
|
|
|
|
9. *References*
|
|
|
|
[1] http://www.xnview.com/.
|
|
[2] http://www.xnview.com/en/xnview/.
|
|
[3]
|
|
http://www.coresecurity.com/system/files/attachments/2013/07/CORE-2013-0705-xnview-poc-4895a357a242d3c78.zip
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/27049.zip
|
|
|
|
10. *About CoreLabs*
|
|
|
|
CoreLabs, the research center of Core Security Technologies, is charged
|
|
with anticipating the future needs and requirements for information
|
|
security technologies. We conduct our research in several important
|
|
areas of computer security including system vulnerabilities, cyber
|
|
attack planning and simulation, source code auditing, and cryptography.
|
|
Our results include problem formalization, identification of
|
|
vulnerabilities, novel solutions and prototypes for new technologies.
|
|
CoreLabs regularly publishes security advisories, technical papers,
|
|
project information and shared software tools for public use at:
|
|
http://corelabs.coresecurity.com.
|
|
|
|
|
|
11. *About Core Security Technologies*
|
|
|
|
Core Security Technologies enables organizations to get ahead of threats
|
|
with security test and measurement solutions that continuously identify
|
|
and demonstrate real-world exposures to their most critical assets. Our
|
|
customers can gain real visibility into their security standing, real
|
|
validation of their security controls, and real metrics to more
|
|
effectively secure their organizations.
|
|
|
|
Core Security's software solutions build on over a decade of trusted
|
|
research and leading-edge threat expertise from the company's Security
|
|
Consulting Services, CoreLabs and Engineering groups. Core Security
|
|
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
|
|
http://www.coresecurity.com.
|
|
|
|
|
|
12. *Disclaimer*
|
|
|
|
The contents of this advisory are copyright (c) 2013 Core Security
|
|
Technologies and (c) 2013 CoreLabs, and are licensed under a Creative
|
|
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
|
|
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
|
|
|
|
|
|
13. *PGP/GPG Keys*
|
|
|
|
This advisory has been signed with the GPG key of Core Security
|
|
Technologies advisories team, which is available for download at
|
|
http://www.coresecurity.com/files/attachments/core_security_advisories.asc. |