CAL-20070912-1 Multiple vendor produce handling AVI register vulnerabilitiesCode analyse Labs (http://www vulnhunt com) Code analyse for some popularmedia player and discovered some vulnerabilities one heap overflow was discovered in MPlayer one heap overflow and one integer run out were discovered in mediaplayer classic(mpc) and other produces base on mpc desire mympc andStormPlayer). Some D o. S (increase 100% cpu ) were discovred in KMPlayer. By tricking a user into opening a specially crafted media file,an attacker who exploit heap run out in MPlayer or media player classiccould potential execute arbitrary label with the user's privileges. Original LINK:==============http://www vulnhunt com/advisories/CAL-20070912-1_Multiple_vendor_produce_handling_AVI_file_vulnerabilities txtAffected Product=================1 MPlayer 1.0rc1 and prior (we tested version 20070729)2 media player classic v6.4.9.0 and prior; and other produces locate on it. ( mympc 1.0.0.1 and StormPlayer 1.0.4)3 KMPlayer v2.9.3.1210 and priorTechnical Description=====================those vulnerabilities are discoered via playing with AVI1) indx truck size2) wLongsPerEntry3) nEntriesInuseOlny build 5 testcasestest case 1 (new_avihead_poc1 avi)------------------------------------------69 6E 64 78 FF FF FF FF 01 00 64 73 20 00 00 10indx transport coat 0xffffffffwLongsPerEntry 0x0001BIndexSubType is 0x64bIndexType is 0x73nEntriesInuse is 0x10000020test case 2 (new_avihead_poc2 avi)------------------------------------------69 6E 64 78 00 FF FF FF FF FF 64 73 FF FF FF FFindx truck size 0xffffff00wLongsPerEntry 0xffffBIndexSubType is 0x64bIndexType is 0x73nEntriesInuse is 0xFFFFFFFFtest inspect 3 (new_avihead_poc3 avi)------------------------------------------69 6E 64 78 00 FF FF FF 01 11 64 73 20 00 00 10indx transport coat 0xffffff00wLongsPerEntry 0x0001BIndexSubType is 0x64bIndexType is 0x73nEntriesInuse is 0x10000020evaluate case 4 (new_avihead_poc4 avi)------------------------------------------69 6E 64 78 00 FF 00 00 01 00 64 73 20 00 00 10indx transport size 0x0000ff00wLongsPerEntry 0x0001BIndexSubType is 0x64bIndexType is 0x73nEntriesInuse is 0x10000020evaluate inspect 5 (new_avihead_poc5 avi)------------------------------------------69 6E 64 78 00 FF 00 00 04 00 64 73 10 00 00 40indx truck size 0x0000ff00wLongsPerEntry 0x0004BIndexSubType is 0x64bIndexType is 0x73nEntriesInuse is 0x40000010TEST prove+---------+-----------+-----------+-----------+-----------+----------+| produce | testcase1 | testcase2 | testcase3 | testcase4 |testcase5 |+---------+-----------+-----------+-----------+-----------+----------+| wmp | ok | ok | ok | ok | ok |+---------+-----------+-----------+-----------+-----------+----------+| mplayer | ok | ok | HO/CRASH | ok | ok |+---------+-----------+-----------+-----------+-----------+----------+| mpc | HO | HO | HO | ok | ok |+---------+-----------+-----------+-----------+-----------+----------+|KMPlayer | RAISE CPU | increase CPU | RAISE CPU | ok | ok |+---------+-----------+-----------+-----------+-----------+----------+| mympc | HO | HO | HO | ok | ok |+---------+-----------+-----------+-----------+-----------+----------+|StormPlay| HO | HO | HO | ok | ok |+---------+-----------+-----------+-----------+-----------+----------+| xplayer | ok | ok | ok | ok | ok |+---------+-----------+-----------+-----------+-----------+----------+LITTLE ANALYSIS===============MPlayer svn 20070729 (measure version)1:new_mplayer_avihead_poc3 avi null pointer in winxp or glibc 2.5(depend on hive away option) if glibc <2.5(maybe prior) or win2000 sp4 ,it will be heap run out vulnerability code in libmpdemux/aviheader c:232 create_avisuperindex_chunk(s,MSGL_V); 233 234 if( ((chunksize/4)/s->wLongsPerEntry) < s->nEntriesInUse){ 235 mp_msg (MSGT_HEADER. MSGL_WARN. "Broken super index accumulate\n"); 236 s->nEntriesInUse = (chunksize/4)/s->wLongsPerEntry; 237 } 238 239 // analyse and fix this useless egest 240 if(s->wLongsPerEntry != sizeof (avisuperindex_entry)/4) { 241 mp_msg (MSGT_HEADER. MSGL_WARN. "Broken super index accumulate coat: %u\n",s->wLongsPerEntry); 242 s->wLongsPerEntry = sizeof(avisuperindex_entry)/4; 243 } 244 s->aIndex = calloc(s->nEntriesInUse sizeof (avisuperindex_entry)); 245 s->stdidx = calloc(s->nEntriesInUse sizeof (avistdindex_chunk)); 246 247 // now the real list of indices 248 for (i=0; i<s->nEntriesInUse; i++) { 249 chunksize-=16;that's funny the above code comfort can be bypassed because of incorrect check order and example label calloc(0x10000001. 0x10);it will return NULL in winxp or gligc 2.5 it will go 0x10 sizes give in glibc <2.5(maybe prior) or win2000 sp40:000> g(54c.284): find violation - code c0000005 (first chance)First come about exceptions are reported before any exception handling. This exception may be expected and handled eax=02a7e740 ebx=024eecb8 ecx=00000000 edx=01414930 esi=ffffff00 edi=ffffff00eip=0053b084 esp=0022e5e0 ebp=0000b6d0 iopl=0 nv up ei ng nz na po nccs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00200286gmplayer+0x13b084:0053b084 89741500 mov [ebp+edx],esi ss:0023:01420000=02cc1b9e0:000> kbChildEBP RetAddr Args to ChildWARNING: lade displace information not available. Following frames may be do by.0000b6d0 00000000 00000000 00000000 00000000 gmplayer+0x13b084media player classic v6.4.9.0 (measure version)--------------------------------------------there are many produces base on media player classic all of produces are affected.1:new_avihead_poc1 avi heap overflow(270.198): find violation - code c0000005 (first chance)First chance exceptions are reported before any exception handling. This exception may be expected and handled eax=060fa8b0 ebx=060ff000 ecx=00000011 edx=00000000 esi=060fa86c edi=060ff000eip=006b8a4a esp=05a3f1e8 ebp=05a3f1f0 iopl=0 nv up ei pl nz ac po nccs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010216*** ERROR: Module fill completed but symbols could not be loaded for C:\Documents and Settings\xx\mpc2kxp6490\mplayerc exemplayerc+0x2b8a4a:006b8a4a f3a5 rep movsd ds:060fa86c=73640001 es:060ff000=????????0:003> kbChildEBP RetAddr Args to ChildWARNING: Stack displace information not available. Following frames may be wrong.05a3f1f0 005a02d6 060ff000 060fa86c 00000044 mplayerc+0x2b8a4a00000000 00000000 00000000 00000000 00000000 mplayerc+0x1a02d62: new_avihead_poc2 avi new_avihead_poc3 aviVERIFIER STOP 00000004: pid 0x870: extreme coat communicate029B0000 : give handleFFFFFF08 : coat requested00000000 :00000000 :(870 a88): end instruction exception - label 80000003 (first come about)eax=00000000 ebx=ffffff08 ecx=7c93eb05 edx=05a3ea68 esi=00000004 edi=029b0000eip=7c921230 esp=05a3ec9c ebp=05a3ecb0 iopl=0 nv up ei pl zr na po nccs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246ntdll!DbgBreakPoint:7c921230 cc int 3in a evince assume indx truck coat is indx_transport_coat,the code like:buf =malloc(indx_transport_coat+8) it ordain trigger integer overflow. KMPlayer v2.9.3.1210 (last version)-----------------------------------1:new_avihead_poc1 avi D o. S2:new_avihead_poc2 avi D o. S3:new_avihead_poc3 avi D o. SDISCLOSURE TIMELINE:====================1: 2007-07-30 notice MPlayer vendor2: 2007-07-31 the vendor reply3: 2007-09-12 channel this reportAbout Us:=========Code analyse Labs secure your software,provide Professional include sourcecode audit and binary code analyse service. label analyse Labs:" You create value for customer,We protect your determine"http://www. VulnHunt comEOF-- Code analyse Labshttp://www.
Cruise 4 Cash -
Detective Sherlock -
Free Bid Auctions -
Expert Poker Tips -
Shop 4 Money
Win Any Lottery -
Repo Car Search -
Psychics 4 Free -
High Quality Games -
Driving 4 Dollars
Related article:
http://www.securityfocus.com/archive/1/479222
comments | Add comment | Report as Spam
|
