bugtraq - [CAL-2011-0052]Adobe Shockwave Player Director File Parsing PAMM memory corruption vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4EB9ECF2.3040008@gmail.com>
Date: Wed, 09 Nov 2011 11:01:06 +0800
From: Code Audit Labs <vulnhunt@...il.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [CAL-2011-0052]Adobe Shockwave Player Director File Parsing PAMM
 memory corruption vulnerability

[CAL-2011-0052]Adobe Shockwave Player Director File Parsing PAMM memory
 corruption vulnerability

CAL ID: CAL-2011-0052
CVE ID: CVE-2011-2446
Discover: instruder of code audit labs of vulnhunt.com
http://www.adobe.com/support/security/bulletins/apsb11-27.html

1 Affected Products
=================
Test Version：Adobe Shockwave Player 11.6.1.629(last)

2 Vulnerability Details
=====================
instruder of code audit labs of vulnhunt.com have discovered a
vulnerability in
Adobe Shockwave Player.when adobe shockwave player parsing header of
Director
 File, although the field of block_count of PAMM atom haved done
strictly limited,
but you can bypass the limit with other fields.Thus in the
cycle,leading to a wrong address to write  to cause Memory corruption.

3 Exploitable?
============
This vulnerability will lead to memory corruption ,Successful exploition
may cause code execution .

4 Crash info:
===============
(308.9d0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=07dd1ff4 ebx=7ffffffb ecx=00007f1f edx=000b8e5c esi=07ed3d48
edi=000093eb
eip=07052920 esp=0227dc9c ebp=00000000 iopl=0         nv up ei ng nz ac
po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00010292
*** ERROR: Module load completed but symbols could not be loaded for
C:\WINDOWS\system32\Adobe\Shockwave 11\DIRAPI.dll
DIRAPI+0x2920:
07052920 6621480c        and     word ptr [eax+0Ch],cx
ds:0023:07dd2000=????
0:005> kb
ChildEBP RetAddr  Args to Child
WARNING: Stack unwind information not available. Following frames may be
wrong.
00000000 00000000 00000000 00000000 00000000 DIRAPI+0x2920

5 Timeline
=========
2011-9-16 report to adobe
2011-9-17 vendor ask poc file
2011-9-17 we sent the poc file.
2011-9-20 vendor comfirm the issue.
2011-11-8 Coordinated public release of advisory.

6 About Code Audit Labs:
=====================
Code Audit Labs secure your software,provide Professional include source
code audit and binary code audit service.
Code Audit Labs:" You create value for customer,We protect your value"
http://www.VulnHunt.com