gif2apng 1.9 – ‘.gif’ Stack Buffer Overflow

• Exploit Database
• 116 阅读

• 作者： Hamm3r.py
  日期： 2018-04-24
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/44519/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92

  # Exploit Title: gif2apng 1.9 &apos;.gif&apos; Stack-Buffer Overflow # Date: 20 April 2018 # Exploit Author: Hamm3r.py # Vendor Homepage: http://gif2apng.sourceforge.net/ # Version: 1.9 # Tested on: Ubuntu 16.04 # CVE :   gif2apng is vulnerable to a stack based buffer overflow when a malformed gif is supplied. Following is the stack trace:   $ ./gif2apng fuzz.gif   gif2apng 1.9 using 7ZIP with 15 iterations   Reading &apos;fuzz.gif&apos;... ================================================================= ==3674==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffb183bcf1 at pc 0x0000004ebdce bp 0x7fffb1837a90 sp 0x7fffb1837a88 WRITE of size 1 at 0x7fffb183bcf1 thread T0 #0 0x4ebdcd (/home/shyam/FUZZ/gif2apng+0x4ebdcd) #1 0x4ee926 (/home/shyam/FUZZ/gif2apng+0x4ee926) #2 0x7f4e5642282f (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #3 0x4199a8 (/home/shyam/FUZZ/gif2apng+0x4199a8)   Address 0x7fffb183bcf1 is located in stack of thread T0 at offset 16977 in frame #0 0x4eb23f (/home/shyam/FUZZ/gif2apng+0x4eb23f)   This frame has 6 object(s): [32, 36) &apos;size&apos; [48, 8242) &apos;prefix&apos; [8512, 12609) &apos;suffix&apos; [12880, 16977) &apos;str&apos; <== Memory access at offset 16977 overflows this variable [17248, 18272) &apos;data&apos; [18400, 18401) &apos;mincodesize&apos; HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/shyam/FUZZ/gif2apng+0x4ebdcd) Shadow bytes around the buggy address: 0x1000762ff740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000762ff750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000762ff760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000762ff770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000762ff780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x1000762ff790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[01]f2 0x1000762ff7a0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 0x1000762ff7b0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 0x1000762ff7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000762ff7d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000762ff7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3674==ABORTING     Version of software in use:   ./gif2apng   gif2apng 1.9   #This issue is identified by Hamm3r.py, a general purpose fuzzer! https://github.com/0xshyam/hamm3r.py       Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44519.zip