GetGo Download Manager 4.x Stack Buffer Overflow

`RCE Security Advisory  
http://www.rcesecurity.com  
  
  
1. ADVISORY INFORMATION  
-----------------------  
Product: GetGo Download Manager  
Vendor URL: www.getgosoft.com  
Type: Stack-based Buffer Overflow [CWE-121]  
Date found: 2014-02-20  
Date published: 2014-03-02  
CVSSv2 Score: 10,0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)  
CVE: CVE-2014-2206  
  
  
2. CREDITS  
----------  
This vulnerability was discovered and researched by Julien Ahrens from  
RCE Security.  
  
  
3. VERSIONS AFFECTED  
--------------------  
GetGo Download Manager v4.9.0.1982 (latest)  
GetGo Download Manager v4.8.2.1346  
GetGo Download Manager v4.4.5.502  
and other older versions may be affected too.  
  
  
4. VULNERABILITY DESCRIPTION  
----------------------------  
A stack-based buffer overflow vulnerability has been identified in the  
GetGo Download Manager.  
  
When a website is requested for download, the application reads the HTTP  
Response Header values of the target page and copies the retrieved  
values to a temporary buffer, which is set to a fixed size of 4097  
bytes, but this size is not used by the application to limit the input  
to the buffer. Instead it fills the buffer byte by byte until the  
terminating sequence "\r\n" is found. Therefore the application writes  
outside the expected memory boundaries if the HTTP Response Header is  
greater than 4097 bytes.  
  
This leads to a stack-based buffer overflow with an overwritten SEH  
chain or return points, resulting in remote code execution. Successful  
exploits can allow remote attackers to execute arbitrary code with the  
privileges of the user running the application. Failed exploits will  
result in a denial-of-service condition.  
  
  
5. PROOF-OF-CONCEPT (DEBUG)  
---------------------------  
Registers:  
EAX 00000000  
ECX CCCCCCCC  
EDX 76F2B4AD ntdll.76F2B4AD  
EBX 00000000  
ESP 0474BD5C  
EBP 0474BD7C  
ESI 00000000  
EDI 00000000  
EIP CCCCCCCC  
C 0 ES 002B 32bit 0(FFFFFFFF)  
P 1 CS 0023 32bit 0(FFFFFFFF)  
A 0 SS 002B 32bit 0(FFFFFFFF)  
Z 1 DS 002B 32bit 0(FFFFFFFF)  
S 0 FS 0053 32bit 7EF94000(FFF)  
T 0 GS 002B 32bit 0(FFFFFFFF)  
D 0  
O 0 LastErr ERROR_SUCCESS (00000000)  
EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)  
ST0 empty g  
ST1 empty g  
ST2 empty g  
ST3 empty g  
ST4 empty g  
ST5 empty g  
ST6 empty g  
ST7 empty g  
3 2 1 0 E S P U O Z D I  
FST 0000 Cond 0 0 0 0 Err 0 0 0 0 0 0 0 0 (GT)  
FCW 027F Prec NEAR,53 Mask 1 1 1 1 1 1  
  
  
Stack:  
ESP-8 > 00286D30  
ESP-4 > FFFFFFFE  
ESP ==> > 76F2B499 RETURN to ntdll.76F2B499  
ESP+4 > 0474BE44  
ESP+8 > 0474D3A8  
[...]  
ESP+1648 > CCCCCCCC  
ESP+164C > CCCCCCCC Pointer to next SEH record  
ESP+1650 > CCCCCCCC SE handler  
ESP+1654 > CCCCCCCC  
  
  
6. VULNERABLE CODE PART  
-----------------------  
// GetGoDM.exe  
004A4CE1 PUSH ECX ; /Arg3  
004A4CE2 PUSH 1001 ; |Arg2 = 00001001  
004A4CE7 LEA EDX,DWORD PTR SS:[EBP-1024] ; |  
004A4CED PUSH EDX ; |Arg1  
004A4CEE MOV ECX,DWORD PTR SS:[EBP-1064] ; |  
004A4CF4 CALL GetGoDM.004A3A70 ; \GetGoDM.004A3A70  
  
  
004A3A70 PUSH EBP  
004A3A71 MOV EBP,ESP  
004A3A73 PUSH -1  
004A3A75 PUSH GetGoDM.00644153  
004A3A7A MOV EAX,DWORD PTR FS:[0]  
004A3A80 PUSH EAX  
004A3A81 SUB ESP,1C  
004A3A84 MOV EAX,DWORD PTR DS:[6E6FB8]  
004A3A89 XOR EAX,EBP  
004A3A8B PUSH EAX  
004A3A8C LEA EAX,DWORD PTR SS:[EBP-C]  
004A3A8F MOV DWORD PTR FS:[0],EAX  
004A3A95 MOV DWORD PTR SS:[EBP-28],ECX  
004A3A98 MOV DWORD PTR SS:[EBP-14],0  
004A3A9F MOV EAX,DWORD PTR SS:[EBP+C]  
004A3AA2 PUSH EAX  
004A3AA3 PUSH 0  
004A3AA5 MOV ECX,DWORD PTR SS:[EBP+8]  
004A3AA8 PUSH ECX  
004A3AA9 CALL GetGoDM.004EA0A0  
004A3AAE ADD ESP,0C  
004A3AB1 MOV DWORD PTR SS:[EBP-18],1  
004A3AB8 MOV DWORD PTR SS:[EBP-10],1  
004A3ABF MOV DWORD PTR SS:[EBP-20],0  
004A3AC6 PUSH GetGoDM.0066D7F6 ; /Arg1 = 0066D7F6  
004A3ACB LEA ECX,DWORD PTR SS:[EBP-1C] ; |  
004A3ACE CALL GetGoDM.004090A0 ; \GetGoDM.004090A0  
004A3AD3 MOV DWORD PTR SS:[EBP-4],0  
004A3ADA /MOV EDX,1  
004A3ADF |TEST EDX,EDX  
004A3AE1 |JE SHORT GetGoDM.004A3B5A  
004A3AE3 |MOV EAX,DWORD PTR SS:[EBP+10]  
004A3AE6 |PUSH EAX ; /Arg3  
004A3AE7 |PUSH 1 ; |Arg2 = 00000001  
004A3AE9 |MOV ECX,DWORD PTR SS:[EBP-10] ; |  
004A3AEC |MOV EDX,DWORD PTR SS:[EBP+8] ; |  
004A3AEF |LEA EAX,DWORD PTR DS:[EDX+ECX-1] ; |  
004A3AF3 |PUSH EAX ; |Arg1  
004A3AF4 |MOV ECX,DWORD PTR SS:[EBP-28] ; |  
004A3AF7 |ADD ECX,0C ; |  
004A3AFA |CALL GetGoDM.0049DF80 ; \GetGoDM.0049DF80  
004A3AFF |MOV DWORD PTR SS:[EBP-18],EAX  
004A3B02 |CMP DWORD PTR SS:[EBP-18],0  
004A3B06 |JNZ SHORT GetGoDM.004A3B11  
004A3B08 |MOV DWORD PTR SS:[EBP-14],0  
004A3B0F |JMP SHORT GetGoDM.004A3B5A  
004A3B11 |MOV ECX,DWORD PTR SS:[EBP+8]  
004A3B14 |ADD ECX,DWORD PTR SS:[EBP-10]  
004A3B17 |MOV BYTE PTR DS:[ECX],0  
004A3B1A |MOV EDX,DWORD PTR SS:[EBP+8]  
004A3B1D |PUSH EDX ; /Arg1  
004A3B1E |LEA ECX,DWORD PTR SS:[EBP-1C] ; |  
004A3B21 |CALL GetGoDM.004497C0 ; \GetGoDM.004497C0  
004A3B26 |PUSH 0 ; /Arg2 = 00000000  
004A3B28 |PUSH GetGoDM.0066D7F8 ; |Arg1 = 0066D7F8 ASCII ""  
004A3B2D |LEA ECX,DWORD PTR SS:[EBP-1C] ; |  
004A3B30 |CALL GetGoDM.00409560 ; \GetGoDM.00409560  
004A3B35 |MOV DWORD PTR SS:[EBP-20],EAX  
004A3B38 |CMP DWORD PTR SS:[EBP-20],-1  
004A3B3C |JE SHORT GetGoDM.004A3B4F  
004A3B3E |MOV EAX,DWORD PTR SS:[EBP+8]  
004A3B41 |ADD EAX,DWORD PTR SS:[EBP-20]  
004A3B44 |MOV BYTE PTR DS:[EAX],0  
004A3B47 |MOV ECX,DWORD PTR SS:[EBP-20]  
004A3B4A |MOV DWORD PTR SS:[EBP-14],ECX  
004A3B4D |JMP SHORT GetGoDM.004A3B5A  
004A3B4F |MOV EDX,DWORD PTR SS:[EBP-10]  
004A3B52 |ADD EDX,1  
004A3B55 |MOV DWORD PTR SS:[EBP-10],EDX  
004A3B58 \JMP SHORT GetGoDM.004A3ADA  
004A3B5A MOV EAX,DWORD PTR SS:[EBP-14]  
004A3B5D MOV DWORD PTR SS:[EBP-24],EAX  
004A3B60 MOV DWORD PTR SS:[EBP-4],-1  
004A3B67 LEA ECX,DWORD PTR SS:[EBP-1C]  
004A3B6A CALL GetGoDM.004091E0  
004A3B6F MOV EAX,DWORD PTR SS:[EBP-24]  
004A3B72 MOV ECX,DWORD PTR SS:[EBP-C]  
004A3B75 MOV DWORD PTR FS:[0],ECX  
004A3B7C POP ECX  
004A3B7D MOV ESP,EBP  
004A3B7F POP EBP  
004A3B80 RETN 0C  
  
  
7. SOLUTION  
-----------  
None  
  
  
8. REPORT TIMELINE  
------------------  
2014-02-23: Discovery of the vulnerability  
2014-02-23: Vendor Notification #1  
2014-02-26: MITRE assigns CVE-2014-2206  
2014-03-01: Project is dead  
2014-03-02: Full Disclosure  
  
  
9 . REFERENCES  
--------------  
http://www.rcesecurity.com/2014/03/cve-2014-2206-getgo-download-manager-http-response-header-buffer-overflow-remote-code-execution  
`