bugtraq - RealNetworks RealPlayer/RealOne Player/Helix Player Remote Memory Corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <001001c81786$22628e80$0a01a8c0@DIED>
Date: Fri, 26 Oct 2007 06:10:23 +0200
From: "Piotr Bania" <bania.piotr@...il.com>
To: "SBUGTRAQ" <bugtraq@...urityfocus.com>,
	"dailydave" <dailydave@...ts.immunitysec.com>,
	"FULLDISC" <full-disclosure@...ts.grok.org.uk>,
	"secunia_vuln" <vuln@...unia.com>
Subject: RealNetworks RealPlayer/RealOne Player/Helix Player Remote Memory Corruption

 RealNetworks RealPlayer/RealOne Player/Helix Player Remote Memory 
Corruption
 by Piotr Bania <bania.piotr@...il.com>
 http://www.piotrbania.com

 Original url (and formating):
 http://www.piotrbania.com/all/adv/realplayer-memory-corruption-adv.txt

 Severity:           Critical - Remote code execution.

 Software affected:  Tested on RealPlayer Version 10.5(newest?) + Harmony
Technology
                     Build: 6.0.12.1483

 Timeline:           02/09/2006 - Advisory sent to RealNetworks
                     05/09/2006 - Initial vendor response
                     25/10/2007 - Advisory released

 I.  BACKGROUND

 Real*Player* is surely one of the most popular media players nowadays
 with over a 200 million of users worldwide.

 II. DESCRIPTION

 The problem exists when Real*Player* parses a special crafted .mov file.
 Here is the vulnerable code:

 --//- snip ----//-----------------------------------------------------

 62448F24   8B4D E2          MOV ECX,DWORD PTR SS:[EBP-1E]     ; (*1)
 62448F27   8B45 DE          MOV EAX,DWORD PTR SS:[EBP-22]
 62448F2A   2BC1             SUB EAX,ECX    ; (*2)
 62448F2C   8B53 17          MOV EDX,DWORD PTR DS:[EBX+17]
 62448F2F   8D3401           LEA ESI,DWORD PTR DS:[ECX+EAX]
 62448F32   8975 FC          MOV DWORD PTR SS:[EBP-4],ESI
 62448F35   3932             CMP DWORD PTR DS:[EDX],ESI
 62448F37   0F82 C2000000    JB rvrender.62448FFF
 62448F3D   8B75 DD          MOV ESI,DWORD PTR SS:[EBP-23]
 62448F40   81E6 FF000000    AND ESI,0FF
 62448F46   3972 14          CMP DWORD PTR DS:[EDX+14],ESI
 62448F49   0F85 B0000000    JNZ rvrender.62448FFF
 62448F4F   8B75 DC          MOV ESI,DWORD PTR SS:[EBP-24]
 62448F52   81E6 FF000000    AND ESI,0FF
 62448F58   837CF2 10 00     CMP DWORD PTR DS:[EDX+ESI*8+10],0
 62448F5D   0F85 9C000000    JNZ rvrender.62448FFF
 62448F63   8B75 08          MOV ESI,DWORD PTR SS:[EBP+8]
 62448F66   0377 04          ADD ESI,DWORD PTR DS:[EDI+4]
 62448F69   8B7A 04          MOV EDI,DWORD PTR DS:[EDX+4]      ; (*3)
 62448F6C   8BD1             MOV EDX,ECX
 62448F6E   03F8             ADD EDI,EAX                       ; (*4)
 62448F70   C1E9 02          SHR ECX,2
 62448F73   F3:A5            REP MOVSD                         ; memcpy()
(*5)

 --//- snip ----//-----------------------------------------------------

 Attacker controls the value of ECX registers initialized at 0x62448F24
(*1).
 This is very important since this values are future used with
initialization
 of EDI register (destination for memcpy() (*5)) and its also used as an
 size argument also for memcpy() (*5) operation.

 The content of EAX register seems to be a const value, equal to 0x326.
 It is transformed by sub operation in the following way: EAX = 0x326 -
ECX(*1).
 From this point the value of the EAX remains unchanged.

 At point (*3) you will see the initalization of EDI register, which will
now
 point somewhere inside allocated heap memory block (the size of the parent
 block seems to be always equal to 0xa8000). After the EDI initialization
 it is normalized with EAX value, created in point (*2).

 This leads to an obvious memory corruption, attacker can control ECX and
the
 EDI register, it means that he can control the destination and the size
 while coping the memory. This may lead to a potencial code execution
 on the vulnerable machine.

 III. IMPACT

 Successful exploitation may allow the attacker to run arbitrary code in
 context of user running Real*Player*.

 IV. POC CODE

 Due to severity of this bug i will not publish any poc codes.

best regards,
pb

-- 
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@...il.com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
http://www.piotrbania.com  - Key ID: 0xBE43AC33
--------------------------------------------------------------------

               - "The more I learn about men, the more I love dogs."