RealPlayer 14.0.1.633 – Heap Overflow
####################################################################### Luigi Auriemma Application: RealPlayer http://www.real.com Versions: <= 14.0.1.633 Platforms: Windows, Macintosh OSX, Linux, Symbian, Palm Bug: heap overflow Exploitation: remote Date: 21 Mar 2011 (found 17 Feb 2011) Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== RealPlayer is an ugly media player developed by RealNetwork and used mainly for its browser's plugin supporting the proprietary file formats of its developer. ####################################################################### ====== 2) Bug ====== Classical heap overflow during the handling of the IVR files caused by the allocation of a certain amount of data (frame size) decided by the attacker and the copying of another arbitrary amount on the same buffer. From rvrender.dll (base address 63AE0000): 63AF5C70 /$ 55 PUSH EBP 63AF5C71 |. 8BEC MOV EBP,ESP 63AF5C73 |. 83EC 20 SUB ESP,20 63AF5C76 |. 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8] 63AF5C79 |. 56 PUSH ESI 63AF5C7A |. 57 PUSH EDI 63AF5C7B |. 8B7A 04 MOV EDI,DWORD PTR DS:[EDX+4] 63AF5C7E |. 8A07 MOV AL,BYTE PTR DS:[EDI] ; byte at offset 0x7800 of the PoC 63AF5C80 |. 24 E0 AND AL,0E0 63AF5C82 |. 33F6 XOR ESI,ESI 63AF5C84 |. 894D F8 MOV DWORD PTR SS:[EBP-8],ECX 63AF5C87 |. 3C E0 CMP AL,0E0 ; (byte & 0xe0) == 0xe0 63AF5C89 |. 0F85 46010000 JNZ rvrender.63AF5DD5 63AF5C8F |. 8B0A MOV ECX,DWORD PTR DS:[EDX] ; 32bit value at offset 0x77f8 (allocation) 63AF5C91 |. 47 INC EDI 63AF5C92 |. 83E9 01 SUB ECX,1 63AF5C95 |. 8975 FC MOV DWORD PTR SS:[EBP-4],ESI 63AF5C98 |. 8975 E8 MOV DWORD PTR SS:[EBP-18],ESI 63AF5C9B |. C745 EC 01000000 MOV DWORD PTR SS:[EBP-14],1 63AF5CA2 |. 894D F0 MOV DWORD PTR SS:[EBP-10],ECX 63AF5CA5 |. 0F84 38010000 JE rvrender.63AF5DE3 63AF5CAB |. 53 PUSH EBX 63AF5CAC |. 8D6424 00 LEA ESP,DWORD PTR SS:[ESP] 63AF5CB0 |> 57 /PUSH EDI 63AF5CB1 |. 8D4D FC |LEA ECX,DWORD PTR SS:[EBP-4] 63AF5CB4 |. 51 |PUSH ECX 63AF5CB5 |. 8D55 E8 |LEA EDX,DWORD PTR SS:[EBP-18] 63AF5CB8 |. 52 |PUSH EDX 63AF5CB9 |. E8 92010000 |CALL rvrender.63AF5E50 63AF5CBE |. 03F8 |ADD EDI,EAX 63AF5CC0 |. 8945 E4 |MOV DWORD PTR SS:[EBP-1C],EAX 63AF5CC3 |. 66:0FB607 |MOVZX AX,BYTE PTR DS:[EDI] 63AF5CC7 |. 0FB7C8 |MOVZX ECX,AX 63AF5CCA |. 83C4 0C |ADD ESP,0C 63AF5CCD |. 84C9 |TEST CL,CL 63AF5CCF |. 79 0D |JNS SHORT rvrender.63AF5CDE 63AF5CD1 |. 83E1 7F |AND ECX,7F 63AF5CD4 |. 894D F4 |MOV DWORD PTR SS:[EBP-C],ECX 63AF5CD7 |. B8 01000000 |MOV EAX,1 63AF5CDC |. EB 1E |JMP SHORT rvrender.63AF5CFC 63AF5CDE |> 66:0FB64F 01 |MOVZX CX,BYTE PTR DS:[EDI+1] 63AF5CE3 |. C1E0 08 |SHL EAX,8 63AF5CE6 |. 66:0BC8 |OR CX,AX 63AF5CE9 |. BA FF7F0000 |MOV EDX,7FFF 63AF5CEE |. 66:23CA |AND CX,DX 63AF5CF1 |. 0FB7C1 |MOVZX EAX,CX ; 16bit at offset 0x7805 63AF5CF4 |. 8945 F4 |MOV DWORD PTR SS:[EBP-C],EAX 63AF5CF7 |. B8 02000000 |MOV EAX,2 63AF5CFC |> 0FB7D8 |MOVZX EBX,AX 63AF5CFF |. 6A 18 |PUSH 18 63AF5D01 |. 03FB |ADD EDI,EBX 63AF5D03 |. E8 FC120000 |CALL <JMP.&MSVCR90.operator new> 63AF5D08 |. 8BF0 |MOV ESI,EAX 63AF5D0A |. 83C4 04 |ADD ESP,4 63AF5D0D |. 85F6 |TEST ESI,ESI 63AF5D0F |. 74 7F |JE SHORT rvrender.63AF5D90 63AF5D11 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4] 63AF5D14 |. 51 |PUSH ECX 63AF5D15 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] 63AF5D18 |. E8 D3F2FFFF |CALL rvrender.63AF4FF0 63AF5D1D |. 85C0 |TEST EAX,EAX 63AF5D1F |. 75 0B |JNZ SHORT rvrender.63AF5D2C 63AF5D21 |. 56 |PUSH ESI 63AF5D22 |. E8 E3120000 |CALL <JMP.&MSVCR90.operator delete> 63AF5D27 |. 83C4 04 |ADD ESP,4 63AF5D2A |. 33F6 |XOR ESI,ESI 63AF5D2C |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8] 63AF5D2F |. 8B0A |MOV ECX,DWORD PTR DS:[EDX] 63AF5D31 |. 8B01 |MOV EAX,DWORD PTR DS:[ECX] 63AF5D33 |. 8B40 0C |MOV EAX,DWORD PTR DS:[EAX+C] 63AF5D36 |. 8D55 E0 |LEA EDX,DWORD PTR SS:[EBP-20] 63AF5D39 |. 52 |PUSH EDX 63AF5D3A |. FFD0 |CALL EAX 63AF5D3C |. 8946 04 |MOV DWORD PTR DS:[ESI+4],EAX 63AF5D3F |. 85C0 |TEST EAX,EAX 63AF5D41 |. 74 4D |JE SHORT rvrender.63AF5D90 63AF5D43 |. 8B4D 08 |MOV ECX,DWORD PTR SS:[EBP+8] 63AF5D46 |. 66:8B51 0C |MOV DX,WORD PTR DS:[ECX+C] 63AF5D4A |. 66:8956 0C |MOV WORD PTR DS:[ESI+C],DX 63AF5D4E |. 0FB755 F4 |MOVZX EDX,WORD PTR SS:[EBP-C] 63AF5D52 |. 0351 08 |ADD EDX,DWORD PTR DS:[ECX+8] 63AF5D55 |. 837D EC 00 |CMP DWORD PTR SS:[EBP-14],0 63AF5D59 |. 8956 08 |MOV DWORD PTR DS:[ESI+8],EDX 63AF5D5C |. 0FB749 0E |MOVZX ECX,WORD PTR DS:[ECX+E] 63AF5D60 |. 66:894E 0E |MOV WORD PTR DS:[ESI+E],CX 63AF5D64 |. 75 0A |JNZ SHORT rvrender.63AF5D70 63AF5D66 |. 81E1 FDFF0000 |AND ECX,0FFFD 63AF5D6C |. 66:894E 0E |MOV WORD PTR DS:[ESI+E],CX 63AF5D70 |> C746 14 00000000 |MOV DWORD PTR DS:[ESI+14],0 63AF5D77 |. C706 00000000 |MOV DWORD PTR DS:[ESI],0 63AF5D7D |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4] 63AF5D80 |. 51 |PUSH ECX ; 32bit at offset 0x7801 63AF5D81 |. 57 |PUSH EDI ; our data 63AF5D82 |. 50 |PUSH EAX ; heap buffer having the size got at 63AF5C8F 63AF5D83 |. E8 F8160000 |CALL <JMP.&MSVCR90.memcpy> ; memcpy 63AF5D88 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4] 63AF5D8B |. 83C4 0C |ADD ESP,0C 63AF5D8E |. 8916 |MOV DWORD PTR DS:[ESI],EDX 63AF5D90 |> 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C] 63AF5D93 |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4] 63AF5D96 |. 8D140B |LEA EDX,DWORD PTR DS:[EBX+ECX] 63AF5D99 |. 8B5D F0 |MOV EBX,DWORD PTR SS:[EBP-10] 63AF5D9C |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] 63AF5D9F |. 03D0 |ADD EDX,EAX 63AF5DA1 |. 2BDA |SUB EBX,EDX 63AF5DA3 |. 56 |PUSH ESI 63AF5DA4 |. 03F8 |ADD EDI,EAX 63AF5DA6 |. 895D F0 |MOV DWORD PTR SS:[EBP-10],EBX 63AF5DA9 |. E8 D2FCFFFF |CALL rvrender.63AF5A80 63AF5DAE |. 56 |PUSH ESI 63AF5DAF |. 8945 E4 |MOV DWORD PTR SS:[EBP-1C],EAX 63AF5DB2 |. E8 53120000 |CALL <JMP.&MSVCR90.operator delete> 63AF5DB7 |. 83C4 04 |ADD ESP,4 63AF5DBA |. C745 EC 00000000 |MOV DWORD PTR SS:[EBP-14],0 63AF5DC1 |. 85DB |TEST EBX,EBX 63AF5DC3 |.^0F85 E7FEFFFF \JNZ rvrender.63AF5CB0 63AF5DC9 |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] 63AF5DCC |. 5B POP EBX 63AF5DCD |. 5F POP EDI 63AF5DCE |. 5E POP ESI 63AF5DCF |. 8BE5 MOV ESP,EBP 63AF5DD1 |. 5D POP EBP 63AF5DD2 |. C2 0400 RETN 4 ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/real_5.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17019.zip the amount of data to copy is the 32bit big endian value located at offset 0x7801 of real_5.ivr. ####################################################################### ====== 4) Fix ====== No fix. ####################################################################### |