Title : Adobe Reader 10.1.4 JP2KLib&CoolType WriteAV Vulnerability
Version : 10.1.4.38
Date : 2012-11-20
Vendor : http://www.adobe.com/
Impact : Med/High
Contact : coolkaveh [at] rocketmail.com
Twitter : @coolkaveh
tested : XP SP3 ENG
Author : coolkaveh
================================================================================
Thanks to @Binjo and others for all support and help
================================================================================
Details:
================================================================================
The parsing routine is really complicated :D
Write AV by some kind of not properly initialized array
But the parameters of memmove, the counter
And destiny pointer seems controllable with data from flatedecoded data.
The wierd thing is the stream encoded with flatedecode can't decode properly
via zlib.decompress, but Adobe seems decode it correctly,
The esi points to a 0x10 length buffer, which contains word or dword calculated
from decoded data, after some integrity checks, it'll reach the memove.
.text:08088FCE mov eax, esi ; jumptable 08087D44 case 8
.text:08088FD0 lea ecx, [ebp+64h+var_1E0]
.text:08088FD6 sub eax, ecx
.text:08088FD8 and eax, 0FFFFFFFCh
.text:08088FDB cmp eax, 10h
.text:08088FDE jl loc_8088496 ; jumptable 08087D2D cases 0,2
.text:08088FE4 push 4
.text:08088FE6 pop eax
.text:08088FE7 sub esi, eax
.text:08088FE9 movsx edi, word ptr [esi+2] ; ff6b -> ffffff6b
.text:08088FED sub esi, eax
.text:08088FEF movsx ecx, word ptr [esi+2] ; 0
.text:08088FF3 sub esi, eax
.text:08088FF5 movsx edx, word ptr [esi+2] ; 0
.text:08088FF9 sub esi, eax
.text:08088FFB mov eax, [ebx+358h]
.text:08089001 mov [ebp+64h+var_68], edx
.text:08089004 movsx edx, word ptr [esi+2] ; 0
.text:08089008 mov [ebp+64h+var_88], ecx
.text:0808900B mov [ebp+64h+var_98], edx ; index
[...]
.text:0808906A cmp edx, 3 ; var_98, can't great than 3
.text:0808906D ja loc_8087D00 ; jumptable 08087D7F case 2
.text:08089073 test ecx, ecx
.text:08089075 jl loc_8087D00 ; jumptable 08087D7F case 2
.text:0808907B add ecx, edi
.text:0808907D cmp ecx, [ebx+360h]
.text:08089083 jg loc_8087D00 ; jumptable 08087D7F case 2
.text:08089089 mov ecx, [ebp+64h+var_68]
.text:0808908C test ecx, ecx
.text:0808908E jl loc_8087D00 ; jumptable 08087D7F case 2
.text:08089094 add ecx, edi
.text:08089096 cmp ecx, [ebx+edx*8+38Ch]
.text:0808909D jg loc_8087D00 ; jumptable 08087D7F case 2
.text:080890A3 mov ecx, edi
.text:080890A5 shl ecx, 2
.text:080890A8 push ecx ; size_t
.text:080890A9 mov ecx, [ebp+64h+var_88]
.text:080890AC lea eax, [eax+ecx*4]
.text:080890AF mov ecx, [ebp+64h+var_68]
.text:080890B2 push eax ; void *
.text:080890B3 mov eax, [ebp+64h+var_98]
.text:080890B6 mov eax, [ebx+eax*8+390h] ; ebx+390h seems a array pointer
.text:080890BD
.text:080890BD loc_80890BD: ; CODE XREF: sub_80875AE+1A1B
.text:080890BD lea eax, [eax+ecx*4]
.text:080890C0 push eax ; void *
.text:080890C1 call ds:memmove
Here, ecx points to a buffer, which contains data the routine used to parse.
.text:0808B103 cmp eax, 0FEh
.text:0808B108 jg short loc_808B12A
.text:0808B10A movzx edx, byte ptr [ecx] ; byte ptr [ecx] = 0x29
.text:0808B10D add eax, 0FFFFFF05h
.text:0808B112 shl eax, 8
.text:0808B115 inc ecx
.text:0808B116 mov [ebp+64h+var_78], ecx
.text:0808B119 push 0FFFFFF94h
.text:0808B11B or eax, edx
.text:0808B11D pop ecx
.text:0808B11E sub ecx, eax
.text:0808B120 shl ecx, 10h
.text:0808B123 mov [esi], ecx ; ecx = ff6b
.text:0808B125 jmp loc_80889B5
This issue needs more investigation , so
Stay in touch
============================================================================================
first memory corruption @ CoolType MSVCR90!memmove
============================================================================================
(d44.c10): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=02644c14
ebx=02643008
ecx=3fffff6b
edx=00000000
esi=02644e68
edi=00000000
eip=7855b36a
esp=0012d4d8
ebp=0012d4e0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\MSVCR90.dll -
MSVCR90!memmove+0x5a:
7855b36a f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
Exception Sub-Type: Write Access Violation
Stack Trace:
MSVCR90!memmove+0x5a
CoolType!CTInit+0x34db9
CoolType+0x14cae
Instruction Address: 0x000000007855b36a
Short Description: WriteAV
============================================================================================
Second memory corruption @ JP2KLib JP2KLib!CIEParamsAreDefaults
============================================================================================
(d0.6a8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=028a56f0
ebx=018126e4
ecx=00000000
edx=00000000
esi=0196893c
edi=00000004
eip=022ea797 esp=022ada98 ebp=022adb1c iopl=0 nv up ei pl nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010212
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Adobe\Reader 11.0\Reader\JP2KLib.dll -
JP2KLib!CIEParamsAreDefaults+0x871:
022ea797 89411c mov dword ptr [ecx+1Ch],eax ds:0023:0000001c=????????
JP2KLib!CIEParamsAreDefaults+0x871:
022ea797 89411c mov dword ptr [ecx+1Ch],eax ds:0023:0000001c=????????
Exception Sub-Type: Write Access Violation
Stack Trace:
JP2KLib!CIEParamsAreDefaults+0x871
JP2KLib!CIEParamsAreDefaults+0x2091
JP2KLib!JP2KCopyRect+0x6fef
MSVCR90!malloc+0x79
AcroRd32!CTJPEGRotateOptions::operator=+0x2268
AcroRd32!AVAcroALM_Destroy+0x84a64
MSVCR90!malloc+0x79
AcroRd32!CTJPEGRotateOptions::operator=+0x29e7
AcroRd32!AVAcroALM_Destroy+0x13886
AcroRd32!AVAcroALM_Destroy+0x7394a
AcroRd32!AVAcroALM_Destroy+0x73ff2
MSVCR90!memcmp+0x1717
AcroRd32!AVAcroALM_Destroy+0x51cbd
AcroRd32!AVAcroALM_Destroy+0x537e8
AcroRd32!AVAcroALM_Destroy+0x1a3a
AcroRd32!AVAcroALM_Destroy+0x9304b
Instruction Address: 0x00000000022ea797
Short Description: WriteAV
============================================================================================
Proof of concept :
CoolType
http://www36.zippyshare.com/v/25032778/file.html
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22878-1.rar
JP2KLib
http://www7.zippyshare.com/v/22655486/file.html
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22878-2.rar
