############################################################################## - RealPentesting Advisory - ############################################################################### Title: User Mode Write Access Violation in Wiz 5.0.3 Severity: Medium History: 16.Apr.2013 Vulnerability reported Authors: Josep Pi Rodriguez, Pedro Guillen Nu?ez, Miguel Angel de Castro Simon Organization: RealPentesting URL: http://www.realpentesting.blogspot.com Product: Wiz Version: 5.0.3 Vendor: Info-Zip Url Vendor: http://www.info-zip.org/ Platform: Windows Type of vulnerability: User Mode Write Access Violation Issue fixed in version: (Not fixed) CVE Identifier: CVE-2013-5659 [ DESCRIPTION SOFTWARE ] From vendor website: Info-ZIP is a diverse, Internet-based workgroup of about 20 primary authors and over one hundred beta-testers, formed in 1990 as a mailing list hosted by Keith Petersen on the original SimTel site at the White Sands Missile Range in New Mexico. [ VULNERABILITY DETAILS ] Wiz 5.03 suffers from a write access violation vulnerability. The memory state after the crash using the output of exploitable module from windbg: eax=00000041 ebx=00003dfc ecx=0012f790 edx=0226b000 esi=01ebd1f1 edi=0012f764 eip=0042aea7 esp=0012f4ec ebp=0012f4ec iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 *** WARNING: Unable to verify checksum for image00400000 *** ERROR: Module load completed but symbols could not be loaded for image00400000 image00400000+0x2aea7: 0042aea7 8802 mov byte ptr [edx],al ds:0023:0226b000=?? rF fpcw=027F: rn 53 puozdi fpsw=0000: top=0 cc=0000 -------- fptw=FFFF fopcode=0000 fpip=0000:00000000 fpdp=0000:00000000 st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 st2=-1.#SNAN0000000000000000e+0000 st3=-1.#SNAN0000000000000000e+0000 st4=-1.#SNAN0000000000000000e+0000 st5=-1.#SNAN0000000000000000e+0000 st6=-1.#SNAN0000000000000000e+0000 st7=-1.#SNAN0000000000000000e+0000 image00400000+0x2aea7: 0042aea7 8802 mov byte ptr [edx],al ds:0023:0226b000=?? rX xmm0=1.05612e-038 9.09185e-039 1.04694e-038 1.10204e-038 xmm1=8.44895e-039 6.15302e-039 5.32661e-039 1.0653e-038 xmm2=1.06531e-038 9.27554e-039 1.07449e-038 1.01938e-038 xmm3=9.2755e-039 2.93888e-039 1.0102e-038 2.9389e-039 xmm4=1.04694e-038 1.05612e-038 1.01021e-038 1.06531e-038 xmm5=1.04694e-038 1.05612e-038 8.449e-039 1.06531e-038 xmm6=7.98982e-039 1.01939e-038 1.04694e-038 1.06531e-038 xmm7=1.09301e-043 1.10203e-038 4.40818e-039 8.26534e-039 image00400000+0x2aea7: 0042aea7 8802 mov byte ptr [edx],al ds:0023:0226b000=?? !exchain 0012ffb0: image00400000+2daec (0042daec) 0012ffe0: kernel32!ValidateLocale+2b0 (7c839ad8) Invalid exception stack at ffffffff !exploitable -m IDENTITY:HostMachine\HostUser PROCESSOR:X86 CLASS:USER QUALIFIER:USER_PROCESS EVENT:DEBUG_EVENT_EXCEPTION EXCEPTION_FAULTING_ADDRESS:0x226b000 EXCEPTION_CODE:0xC0000005 EXCEPTION_LEVEL:SECOND_CHANCE EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION EXCEPTION_SUBTYPE:WRITE MAJOR_HASH:0x00020e6f MINOR_HASH:0x24590159 STACK_DEPTH:15 STACK_FRAME:image00400000+0x2aea7 STACK_FRAME:image00400000+0x2af22 STACK_FRAME:image00400000+0x275c2 STACK_FRAME:image00400000+0x5a8a STACK_FRAME:image00400000+0x5c7f STACK_FRAME:image00400000+0xfed3 STACK_FRAME:image00400000+0x1b7be STACK_FRAME:image00400000+0x17876 STACK_FRAME:image00400000+0x10f68 STACK_FRAME:image00400000+0x105a9 STACK_FRAME:image00400000+0xfdd2 STACK_FRAME:image00400000+0xfe72 STACK_FRAME:image00400000+0xce1f STACK_FRAME:image00400000+0xe21e STACK_FRAME:kernel32!RegisterWaitForInputIdle+0x49 INSTRUCTION_ADDRESS:0x000000000042aea7 INVOKING_STACK_FRAME:0 DESCRIPTION:User Mode Write AV SHORT_DESCRIPTION:WriteAV CLASSIFICATION:EXPLOITABLE BUG_TITLE:Exploitable - User Mode Write AV starting at image00400000+0x000000000002aea7 (Hash=0x00020e6f.0x24590159) EXPLANATION:User mode write access violations that are not near NULL are exploitable.!msec.exploitable -m [ VENDOR COMMUNICATION ] 16/04/2013 : vendor contacted 16/04/2013: vendor ask about details 20/04/2013: No response from vendor. 29/04/2013: PUBLIC DISCLOSURE