Title : Adobe Reader 10.1.4 JP2KLib&CoolType WriteAV Vulnerability Version : 10.1.4.38 Date : 2012-11-20 Vendor : http://www.adobe.com/ Impact : Med/High Contact : coolkaveh [at] rocketmail.com Twitter : @coolkaveh tested : XP SP3 ENG Author : coolkaveh === Thanks to @Binjo and others for all support and help === Details: === The parsing routine is really complicated :D Write AV by some kind of not properly initialized array But the parameters of memmove, the counter And destiny pointer seems controllable with data from flatedecoded data. The wierd thing is the stream encoded with flatedecode can't decode properly via zlib.decompress, but Adobe seems decode it correctly, The esi points to a 0x10 length buffer, which contains word or dword calculated from decoded data, after some integrity checks, it'll reach the memove. .text:08088FCE mov eax, esi ; jumptable 08087D44 case 8 .text:08088FD0 lea ecx, [ebp+64h+var_1E0] .text:08088FD6 sub eax, ecx .text:08088FD8 and eax, 0FFFFFFFCh .text:08088FDB cmp eax, 10h .text:08088FDE jl loc_8088496 ; jumptable 08087D2D cases 0,2 .text:08088FE4 push 4 .text:08088FE6 pop eax .text:08088FE7 sub esi, eax .text:08088FE9 movsx edi, word ptr [esi+2] ; ff6b -> ffffff6b .text:08088FED sub esi, eax .text:08088FEF movsx ecx, word ptr [esi+2] ; 0 .text:08088FF3 sub esi, eax .text:08088FF5 movsx edx, word ptr [esi+2] ; 0 .text:08088FF9 sub esi, eax .text:08088FFB mov eax, [ebx+358h] .text:08089001 mov [ebp+64h+var_68], edx .text:08089004 movsx edx, word ptr [esi+2] ; 0 .text:08089008 mov [ebp+64h+var_88], ecx .text:0808900B mov [ebp+64h+var_98], edx ; index [...] .text:0808906A cmp edx, 3 ; var_98, can't great than 3 .text:0808906D ja loc_8087D00 ; jumptable 08087D7F case 2 .text:08089073 test ecx, ecx .text:08089075 jl loc_8087D00 ; jumptable 08087D7F case 2 .text:0808907B add ecx, edi .text:0808907D cmp ecx, [ebx+360h] .text:08089083 jg loc_8087D00 ; jumptable 08087D7F case 2 .text:08089089 mov ecx, [ebp+64h+var_68] .text:0808908C test ecx, ecx .text:0808908E jl loc_8087D00 ; jumptable 08087D7F case 2 .text:08089094 add ecx, edi .text:08089096 cmp ecx, [ebx+edx*8+38Ch] .text:0808909D jg loc_8087D00 ; jumptable 08087D7F case 2 .text:080890A3 mov ecx, edi .text:080890A5 shl ecx, 2 .text:080890A8 push ecx ; size_t .text:080890A9 mov ecx, [ebp+64h+var_88] .text:080890AC lea eax, [eax+ecx*4] .text:080890AF mov ecx, [ebp+64h+var_68] .text:080890B2 push eax ; void * .text:080890B3 mov eax, [ebp+64h+var_98] .text:080890B6 mov eax, [ebx+eax*8+390h] ; ebx+390h seems a array pointer .text:080890BD .text:080890BD loc_80890BD: ; CODE XREF: sub_80875AE+1A1B .text:080890BD lea eax, [eax+ecx*4] .text:080890C0 push eax ; void * .text:080890C1 call ds:memmove Here, ecx points to a buffer, which contains data the routine used to parse. .text:0808B103 cmp eax, 0FEh .text:0808B108 jg short loc_808B12A .text:0808B10A movzx edx, byte ptr [ecx] ; byte ptr [ecx] = 0x29 .text:0808B10D add eax, 0FFFFFF05h .text:0808B112 shl eax, 8 .text:0808B115 inc ecx .text:0808B116 mov [ebp+64h+var_78], ecx .text:0808B119 push 0FFFFFF94h .text:0808B11B or eax, edx .text:0808B11D pop ecx .text:0808B11E sub ecx, eax .text:0808B120 shl ecx, 10h .text:0808B123 mov [esi], ecx ; ecx = ff6b .text:0808B125 jmp loc_80889B5 This issue needs more investigation , so Stay in touch =============== first memory corruption @ CoolType MSVCR90!memmove =============== (d44.c10): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=02644c14 ebx=02643008 ecx=3fffff6b edx=00000000 esi=02644e68 edi=00000000 eip=7855b36a esp=0012d4d8 ebp=0012d4e0 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\MSVCR90.dll - MSVCR90!memmove+0x5a: 7855b36a f3a5 rep movs dword ptr es:[edi],dword ptr [esi] Exception Sub-Type: Write Access Violation Stack Trace: MSVCR90!memmove+0x5a CoolType!CTInit+0x34db9 CoolType+0x14cae Instruction Address: 0x000000007855b36a Short Description: WriteAV =============== Second memory corruption @ JP2KLib JP2KLib!CIEParamsAreDefaults =============== (d0.6a8): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=028a56f0 ebx=018126e4 ecx=00000000 edx=00000000 esi=0196893c edi=00000004 eip=022ea797 esp=022ada98 ebp=022adb1c iopl=0 nv up ei pl nz ac po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010212 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Adobe\Reader 11.0\Reader\JP2KLib.dll - JP2KLib!CIEParamsAreDefaults+0x871: 022ea797 89411c mov dword ptr [ecx+1Ch],eax ds:0023:0000001c=???????? JP2KLib!CIEParamsAreDefaults+0x871: 022ea797 89411c mov dword ptr [ecx+1Ch],eax ds:0023:0000001c=???????? Exception Sub-Type: Write Access Violation Stack Trace: JP2KLib!CIEParamsAreDefaults+0x871 JP2KLib!CIEParamsAreDefaults+0x2091 JP2KLib!JP2KCopyRect+0x6fef MSVCR90!malloc+0x79 AcroRd32!CTJPEGRotateOptions::operator=+0x2268 AcroRd32!AVAcroALM_Destroy+0x84a64 MSVCR90!malloc+0x79 AcroRd32!CTJPEGRotateOptions::operator=+0x29e7 AcroRd32!AVAcroALM_Destroy+0x13886 AcroRd32!AVAcroALM_Destroy+0x7394a AcroRd32!AVAcroALM_Destroy+0x73ff2 MSVCR90!memcmp+0x1717 AcroRd32!AVAcroALM_Destroy+0x51cbd AcroRd32!AVAcroALM_Destroy+0x537e8 AcroRd32!AVAcroALM_Destroy+0x1a3a AcroRd32!AVAcroALM_Destroy+0x9304b Instruction Address: 0x00000000022ea797 Short Description: WriteAV =============== Proof of concept : CoolType http://www36.zippyshare.com/v/25032778/file.html JP2KLib http://www7.zippyshare.com/v/22655486/file.html