lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <50D13E31158CB84E8421A703294682FB1421F5B84D@USEXCHANGE.ad.checkpoint.com>
Date: Wed, 25 Aug 2010 06:02:28 -0700
From: Rodrigo Branco <rbranco@...ckpoint.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Adobe Shockwave Player Memory Corruption
 Vulnerability - CVE-2010-2869

I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability.



Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/

Memory corruption when Adobe Shockwave Player parses .dir media file
CVE-2010-2869


INTRODUCTION

Adobe Shockwave Player is the Adobe plugin to many different browsers to view rich-media content on the web including animations, interactive presentations, and online entertainment.

Adobe Shockwave player does not properly parse .dir media file, which causes a corruption in module IML32.dll by opening a malformed file with an invalid value located in PoC repro10.dir at offset 0x3712.

This problem was confirmed in the following versions of Adobe Shockwave Player, other versions may be also affected.

Shockwave Player version 11.5.7.609 and older for Windows and MacOS


CVSS Scoring System

The CVSS score is: 9
	Base Score: 10
	Temporal Score: 9
We used the following values to calculate the scores:
	Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C
	Temporal score is: E:POC/RL:U/RC:C


TRIGGERING THE PROBLEM

To trigger the problem a PoC file (repro10.dir) is available to interested parts. 


DETAILS

Disassembly:

7C9011DD > 8BFF             MOV EDI,EDI
7C9011DF   55               PUSH EBP
7C9011E0   8BEC             MOV EBP,ESP
7C9011E2   83EC 54          SUB ESP,54
7C9011E5   56               PUSH ESI
7C9011E6   64:A1 18000000   MOV EAX,DWORD PTR FS:[18]
7C9011EC   803D 94E0977C 00 CMP BYTE PTR DS:[7C97E094],0
7C9011F3   8B75 08          MOV ESI,DWORD PTR SS:[EBP+8]
7C9011F6   8945 FC          MOV DWORD PTR SS:[EBP-4],EAX
7C9011F9   0F85 F7EC0000    JNZ ntdll.7C90FEF6
7C9011FF   F646 10 10       TEST BYTE PTR DS:[ESI+10],10
7C901203   0F84 EDEC0000    JE ntdll.7C90FEF6
7C901209   5E               POP ESI
7C90120A   C9               LEAVE
7C90120B   C2 0400          RETN 4
7C90120E > CC               INT3
7C90120F   C3               RETN 	<--- Stop Here :)

EIP = 0x00000000


CREDITS

This vulnerability was discovered and researched by Rodrigo Rubira Branco from Check Point Vulnerability Discovery Team (VDT).



Best Regards,
 
Rodrigo.
 
--
Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ