####################################################################### Luigi Auriemma Application: XnView http://www.xnview.com Versions: <= 1.98.5 Platforms: Windows Bugs: A] integer overflow in width/height calculation B] jpeg heap overflow C] ICO heap overflow D] PCX heap overflow E] FLI heap overflow Exploitation: via file Date: 16 Feb 2012 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== "XnView is an efficient multimedia viewer, browser and converter supporting more than 400 graphics formats" ####################################################################### ======= 2) Bugs ======= Note that this program has been tested only for a quick blind experiment of some minutes so this advisory is not much completed or detailed. ----------------------------------------------- A] integer overflow in width/height calculation ----------------------------------------------- The function that handles the width/height of the screen used for any file format if affected by some integer overflow vulnerabilities: 0047DB20 /$ 83EC 18 SUB ESP,18 ... 0047DB78 |> 8B4424 38 MOV EAX,DWORD PTR SS:[ESP+38] 0047DB7C |. 8B4C24 3C MOV ECX,DWORD PTR SS:[ESP+3C] 0047DB80 |. 8B6C24 34 MOV EBP,DWORD PTR SS:[ESP+34] 0047DB84 |. 8947 08 MOV DWORD PTR DS:[EDI+8],EAX 0047DB87 |. 894F 0C MOV DWORD PTR DS:[EDI+C],ECX 0047DB8A |. 8B55 00 MOV EDX,DWORD PTR SS:[EBP] 0047DB8D |. 8957 10 MOV DWORD PTR DS:[EDI+10],EDX 0047DB90 |. 8B4D 04 MOV ECX,DWORD PTR SS:[EBP+4] 0047DB93 |. 8D1485 00000000 LEA EDX,DWORD PTR DS:[EAX*4] ; integer overflow 0047DB9A |. 894F 14 MOV DWORD PTR DS:[EDI+14],ECX 0047DB9D |. 52 PUSH EDX 0047DB9E |. E8 B8311400 CALL xnview.005C0D5B ; malloc 0047DBA3 |. 8907 MOV DWORD PTR DS:[EDI],EAX 0047DBA5 |. 8B47 0C MOV EAX,DWORD PTR DS:[EDI+C] 0047DBA8 |. C1E0 02 SHL EAX,2 ; integer overflow 0047DBAB |. 50 PUSH EAX 0047DBAC |. E8 AA311400 CALL xnview.005C0D5B ; malloc 0047DBB1 |. 8B4F 08 MOV ECX,DWORD PTR DS:[EDI+8] 0047DBB4 |. 8947 04 MOV DWORD PTR DS:[EDI+4],EAX 0047DBB7 |. 8B45 00 MOV EAX,DWORD PTR SS:[EBP] 0047DBBA |. 83C4 08 ADD ESP,8 0047DBBD |. 3BC8 CMP ECX,EAX 0047DBBF |. 75 51 JNZ SHORT xnview.0047DC12 0047DBC1 |. 8B57 0C MOV EDX,DWORD PTR DS:[EDI+C] 0047DBC4 |. 8B45 04 MOV EAX,DWORD PTR SS:[EBP+4] 0047DBC7 |. 3BD0 CMP EDX,EAX 0047DBC9 |. 75 47 JNZ SHORT xnview.0047DC12 0047DBCB |. 33C0 XOR EAX,EAX 0047DBCD |. 3BCE CMP ECX,ESI 0047DBCF |. 7E 16 JLE SHORT xnview.0047DBE7 0047DBD1 |> 33C9 /XOR ECX,ECX ; write loop 0047DBD3 |. 8B17 |MOV EDX,DWORD PTR DS:[EDI] 0047DBD5 |. 66:8B4D 0E |MOV CX,WORD PTR SS:[EBP+E] 0047DBD9 |. 0FAFC8 |IMUL ECX,EAX 0047DBDC |. 890C82 |MOV DWORD PTR DS:[EDX+EAX*4],ECX 0047DBDF |. 8B4F 08 |MOV ECX,DWORD PTR DS:[EDI+8] 0047DBE2 |. 40 |INC EAX 0047DBE3 |. 3BC1 |CMP EAX,ECX 0047DBE5 |.^7C EA \JL SHORT xnview.0047DBD1 0047DBE7 |> 8B4F 0C MOV ECX,DWORD PTR DS:[EDI+C] 0047DBEA |. 33C0 XOR EAX,EAX 0047DBEC |. 3BCE CMP ECX,ESI 0047DBEE |. 0F8E B6000000 JLE xnview.0047DCAA 0047DBF4 |> 8B4D 08 /MOV ECX,DWORD PTR SS:[EBP+8] ; write loop 0047DBF7 |. 8B75 28 |MOV ESI,DWORD PTR SS:[EBP+28] 0047DBFA |. 0FAFC8 |IMUL ECX,EAX 0047DBFD |. 8B57 04 |MOV EDX,DWORD PTR DS:[EDI+4] 0047DC00 |. 03CE |ADD ECX,ESI 0047DC02 |. 890C82 |MOV DWORD PTR DS:[EDX+EAX*4],ECX 0047DC05 |. 8B4F 0C |MOV ECX,DWORD PTR DS:[EDI+C] 0047DC08 |. 40 |INC EAX 0047DC09 |. 3BC1 |CMP EAX,ECX 0047DC0B |.^7C E7 \JL SHORT xnview.0047DBF4 0047DC0D |. E9 98000000 JMP xnview.0047DCAA The content of the 32bit value to write depends by the file format and the continuation of the execution after the exception may depend by the system in use (more chances using Windows 7). --------------------- B] jpeg heap overflow --------------------- Heap overflow during the handling of the "Samples per Line" in the Baseline DCT header: 006E1E5B > 8B7424 3C MOV ESI,DWORD PTR SS:[ESP+3C] 006E1E5F . 8B6C24 14 MOV EBP,DWORD PTR SS:[ESP+14] 006E1E63 > 33DB XOR EBX,EBX 006E1E65 . 83C1 03 ADD ECX,3 006E1E68 . 8A1C06 MOV BL,BYTE PTR DS:[ESI+EAX] 006E1E6B . 8BF3 MOV ESI,EBX 006E1E6D . 33DB XOR EBX,EBX 006E1E6F . 8A18 MOV BL,BYTE PTR DS:[EAX] 006E1E71 . 8BFB MOV EDI,EBX 006E1E73 . 33DB XOR EBX,EBX 006E1E75 . 8A1C28 MOV BL,BYTE PTR DS:[EAX+EBP] 006E1E78 . 8BEB MOV EBP,EBX 006E1E7A . 8B5C24 18 MOV EBX,DWORD PTR SS:[ESP+18] 006E1E7E . 8B1CAB MOV EBX,DWORD PTR DS:[EBX+EBP*4] 006E1E81 . 03DE ADD EBX,ESI 006E1E83 . 8A1413 MOV DL,BYTE PTR DS:[EBX+EDX] 006E1E86 . 8851 FD MOV BYTE PTR DS:[ECX-3],DL 006E1E89 . 8B5424 1C MOV EDX,DWORD PTR SS:[ESP+1C] 006E1E8D . 8B1CBA MOV EBX,DWORD PTR DS:[EDX+EDI*4] 006E1E90 . 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20] 006E1E94 . 031CAA ADD EBX,DWORD PTR DS:[EDX+EBP*4] 006E1E97 . 8B5424 24 MOV EDX,DWORD PTR SS:[ESP+24] 006E1E9B . C1FB 10 SAR EBX,10 006E1E9E . 03DE ADD EBX,ESI 006E1EA0 . 8A1C13 MOV BL,BYTE PTR DS:[EBX+EDX] 006E1EA3 . 8859 FE MOV BYTE PTR DS:[ECX-2],BL 006E1EA6 . 8B5C24 28 MOV EBX,DWORD PTR SS:[ESP+28] 006E1EAA . 8B3CBB MOV EDI,DWORD PTR DS:[EBX+EDI*4] 006E1EAD . 03FE ADD EDI,ESI 006E1EAF . 8B7424 34 MOV ESI,DWORD PTR SS:[ESP+34] 006E1EB3 . 40 INC EAX 006E1EB4 . 4E DEC ESI 006E1EB5 . 8A1C17 MOV BL,BYTE PTR DS:[EDI+EDX] 006E1EB8 . 897424 34 MOV DWORD PTR SS:[ESP+34],ESI 006E1EBC . 8859 FF MOV BYTE PTR DS:[ECX-1],BL 006E1EBF .^75 9A JNZ SHORT xnview.006E1E5B -------------------- C] ICO heap overflow -------------------- Heap overflow during the handling of an ICO file with a smaller number of bits per pixels than how much specified in the main header. -------------------- D] PCX heap overflow -------------------- Heap overflow in the handling of the PCX files. The provided proof-of-concept should result in EIP 0x61616161. -------------------- E] FLI heap overflow -------------------- Heap overflow in the handling of the frames in the FLI files. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/xnview_1.zip http://www.exploit-db.com/sploits/18491.zip ####################################################################### ====== 4) Fix ====== No fix. #######################################################################