Industry Trends
Windows Journal Vulnerability Disclosed Plus A Weekend Bonus
FortiGuard Labs disclosed a heap overflow vulnerability earlier this week in Windows Journal, a notetaking application developed by Microsoft that is included in Windows XP Tablet PC Edition, Windows Vista, Windows 7, Windows 8, and Windows 10. Windows Journal allows users to create and organize handwritten notes and drawings and save them in native JNT files or export them in TIFF files. It also allows users to simply use an ordinary computer mouse to compose a handwritten note, as well as a graphics tablet or a Tablet PC.
The vulnerability is caused by an error that occurs when the vulnerable software attempts to open a specially crafted .jnt file. It could lead to remote code execution, with particular implications for those using Windows accounts with administrator privileges.
Specifically, the vulnerability is caused by an error while parsing the ‘BPGR’ structure in a specially crafted jnt file. Let’s look into the jnt file:
0002bb10h: 00 42 50 47 52 02 00 00 00 06 00 93 00 3D 00 00 ; .BPGR.......?=..
0002bb20h: 00 06 09 20 08 53 A9 45 2D 02 12 60 08 00 60 0A ; ... .S〦-..`..`.
0002bb30h: 24 42 A4 82 D5 12 B5 50 85 C8 00 05 28 4A 82 E8 ; $B?礟吶..(J傝
0002bb40h: 00 43 05 38 36 87 29 00 14 00 6E 00 42 50 47 52 ; .C.86?...n.BPGR
0002bb50h: 02 00 00 00 03 00 00 00 3D 00 00 00 03 41 ED 80 ; ........=....A韤
0002bb60h: F5 4A AA A0 00 A1 BF 36 C1 1B 21 0A 84 22 40 14 ; 鮆獱.】6?!.?@.
0002bb70h: 00 6E 00 42 50 47 52 02 00 00 00 0B 00 00 00 12 ; .n.BPGR.........
0002bb80h: 00 00 00 0B 54 4B 00 ; ....TK.
Since the specification of JNT file format is not available, we guess that the four bytes marked in red |06 00 93 00| should be a size field. The value in little-endian is 0x00930060, which is crafted by us.
The function CDecbp::Decode(short *, unsigned __int64, int *) is used to parse the ‘BPGR’ structure, and the function flow chart is shown below:
Let’s set breakpoint in function NBDoc!CDecbp::Decode for further analysis:
0:000> r
rax=00000060ec9ecfc0 rbx=00000060ec9eaf80 rcx=00000060dc7ed3a0
rdx=00000060ec9e8f80 rsi=00000060ec9e2fc0 rdi=00000060ec9e6fd0
rip=00007ffd6164ebb0 rsp=00000060dc7ed2a8 rbp=00000060dc7ed3b0
r8=000000000000003d r9=00000060dc7ed2f0 r10=00000060ec9ecfc0
r11=00000060dc7ece50 r12=000000008007000e r13=0000000000000000
r14=00000060ec9e8f80 r15=00000060ec9e4fd0
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
00007ffd`6164ebb0 48895c2410 mov qword ptr [rsp+10h],rbx ss:00000060`dc7ed2b8=00000060ec9eaf80
0:000> dd 00000060`dc7ed3a0 //this pointer points to a CDecbp object
00000060`dc7ed3a0 00000002 00930006 0000003d 00000000 //the four bytes marked in red are from the specially crafted ‘BPGR’ structure
00000060`dc7ed3b0 ec9b8f50 00000060 000000ac 00000000
00000060`dc7ed3c0 ec9df000 00000060 850ca996 00007ffd
00000060`dc7ed3d0 e03f0000 00000060 e03f0000 00000060
00000060`dc7ed3e0 00000000 00000000 00000000 00000000
00000060`dc7ed3f0 fffffffe ffffffff ec9eaf80 00000060
00000060`dc7ed400 ec9e6fd0 00000060 ec9e2fc0 00000060
00000060`dc7ed410 ec9e8f80 00000060 ec9e4fd0 00000060
0:000> dd 00000060`ec9b8f50
00000060`ec9b8f50 2d45a953`08200906 240a6000`08601202
00000060`ec9b8f60 8550b512`d582a442 00e8824a`280500c8
00000060`ec9b8f70 14002987`36380543 02524750`42006e00
00000060`ec9b8f80 3d000000`03000000 f580ed41`03000000
00000060`ec9b8f90 c136bfa1`00a0aa4a 00144022`840a211b
00000060`ec9b8fa0 00025247`5042006e 00120000`000b0000
00000060`ec9b8fb0 0200004b`540b0000 0055d3db`60e96240
00000060`ec9b8fc0 ef070014`d6807174 2c40ef8a`8096d0c0
From the above flow chart of the function CDecbp::Decode, we can see there is a while loop, and the condition used in it is as follows:
NBDoc!CDecbp::Decode+0x1d4:
00007ffd`6164ed84 453bf9 cmp r15d,r9d
00007ffd`6164ed87 0f8cddfeffff jl NBDoc!CDecbp::Decode+0xba (00007ffd`6164ec6a) // if r15d < r9d, it continues to loop
0:000> r
rax=0000000000000003 rbx=0000000000000000 rcx=00000060dc7ed3a0
rdx=00000060dc7ed2b0 rsi=0000000000000000 rdi=00000060dc7ed3a0
rip=00007ffd6164ed84 rsp=00000060dc7ed240 rbp=00000060ec9ecfc0
r8=00000060ec9ecffc r9=0000000000930006 r10=0000000000000001
r11=0000000000000008 r12=0000000000000004 r13=000000000000003d
r14=00000060ec9e8f80 r15=0000000000000001
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
NBDoc!CDecbp::Decode+0x1d4:
00007ffd`6164ed84 453bf9 cmp r15d,r9d
0:000> u
NBDoc!CDecbp::Decode+0x1d4:
00007ffd`6164ed84 453bf9 cmp r15d,r9d
00007ffd`6164ed87 0f8cddfeffff jl NBDoc!CDecbp::Decode+0xba (00007ffd`6164ec6a)
00007ffd`6164ed8d 488bb42488000000 mov rsi,qword ptr [rsp+88h]
00007ffd`6164ed95 395f08 cmp dword ptr [rdi+8],ebx
00007ffd`6164ed98 7e21 jle NBDoc!CDecbp::Decode+0x20b (00007ffd`6164edbb)
00007ffd`6164ed9a 488bcd mov rcx,rbp
00007ffd`6164ed9d f60101 test byte ptr [rcx],1
00007ffd`6164eda0 740b je NBDoc!CDecbp::Decode+0x1fd (00007ffd`6164edad)
The value of the register r15d is 0x1 and the value of the register r9d is 0x00930006 which is from the specially crafted ‘BPGR’ structure. 0x00930006 is a very large integer and causes the loop to execute many times. In each loop, this pointer points to a CDecbp object and poi(this +0x10) is increased by one several times. Some code snippets are shown below:
NBDoc!CDecbp::Decode+0x6b:
00007ffd`6164ec1b 488b4710 mov rax,qword ptr [rdi+10h] ---> rdx points to this pointer.
00007ffd`6164ec1f 0fb608 movzx ecx,byte ptr [rax]
00007ffd`6164ec22 48ffc0 inc rax ---> poi(this+10h) is increased by one
00007ffd`6164ec25 448bc9 mov r9d,ecx
00007ffd`6164ec28 48894710 mov qword ptr [rdi+10h],rax ---> update the value of this+10h
00007ffd`6164ec2c 488d42ff lea rax,[rdx-1]
NBDoc!CDecbp::Decode+0xec:
00007ffd`6164ec9c 488b4f10 mov rcx,qword ptr [rdi+10h] ---> rdi points to this pointer.
00007ffd`6164eca0 c7472808000000 mov dword ptr [rdi+28h],8
00007ffd`6164eca7 0fb601 movzx eax,byte ptr [rcx]
00007ffd`6164ecaa 894724 mov dword ptr [rdi+24h],eax
00007ffd`6164ecad 488d4101 lea rax,[rcx+1] ---> poi(this+10h) is increased by one
00007ffd`6164ecb1 48894710 mov qword ptr [rdi+10h],rax ---> update the value of this+10h
00007ffd`6164ecb5 ff4f28 dec dword ptr [rdi+28h]
00007ffd`6164ecb8 48634f28 movsxd rcx,dword ptr [rdi+28h]
NBDoc!CDecbp::DecGRAdapt+0x96:
00007ffd`6164ee96 498b4910 mov rcx,qword ptr [r9+10h] ---> r9 points to this pointer.
00007ffd`6164ee9a 45895928 mov dword ptr [r9+28h],r11d
00007ffd`6164ee9e 0fb601 movzx eax,byte ptr [rcx]
00007ffd`6164eea1 41894124 mov dword ptr [r9+24h],eax
00007ffd`6164eea5 488d4101 lea rax,[rcx+1] ---> poi(this+10h) is increased by one
00007ffd`6164eea9 49894110 mov qword ptr [r9+10h],rax ---> update the value of this+10h
00007ffd`6164eead 41ff4928 dec dword ptr [r9+28h]
00007ffd`6164eeb1 418d4001 lea eax,[r8+1]
NBDoc!CDecbp::DecGRAdapt+0x48:
00007ffd`6164ee48 488b4910 mov rcx,qword ptr [rcx+10h] ---> rcx points to this pointer.
00007ffd`6164ee4c 0fb601 movzx eax,byte ptr [rcx]
00007ffd`6164ee4f 41894124 mov dword ptr [r9+24h],eax
00007ffd`6164ee53 488d4101 lea rax,[rcx+1] ---> poi(this+10h) is increased by one
00007ffd`6164ee57 49894110 mov qword ptr [r9+10h],rax ---> update the value of this+10h
00007ffd`6164ee5b 41ff4928 dec dword ptr [r9+28h]
00007ffd`6164ee5f 488d35d2bb0900 lea rsi,[NBDoc!`string'+0x2f8 (00007ffd`616eaa38)]
00007ffd`6164ee66 49634928 movsxd rcx,dword ptr [r9+28h]
NBDoc!CDecbp::DecGRAdapt+0x11a:
00007ffd`6164ef1a 498b4910 mov rcx,qword ptr [r9+10h] --->r9 points to this pointer.
00007ffd`6164ef1e 45895928 mov dword ptr [r9+28h],r11d
00007ffd`6164ef22 0fb601 movzx eax,byte ptr [rcx]
00007ffd`6164ef25 41894124 mov dword ptr [r9+24h],eax
00007ffd`6164ef29 488d4101 lea rax,[rcx+1] ---> poi(this+10h) is increased by one
00007ffd`6164ef2d 49894110 mov qword ptr [r9+10h],rax ---> update the value of this+10h
00007ffd`6164ef31 41ff4928 dec dword ptr [r9+28h]
00007ffd`6164ef35 4d634128 movsxd r8,dword ptr [r9+28h]
NBDoc!CDecbp::DecGRAdapt+0x225:
00007ffd`6164f025 498b5110 mov rdx,qword ptr [r9+10h] --->r9 points to this pointer.
00007ffd`6164f029 418b4924 mov ecx,dword ptr [r9+24h]
00007ffd`6164f02d c1e108 shl ecx,8
00007ffd`6164f030 0fb602 movzx eax,byte ptr [rdx]
00007ffd`6164f033 0bc8 or ecx,eax
00007ffd`6164f035 488d4201 lea rax,[rdx+1] ---> poi(this+10h) is increased by one
00007ffd`6164f039 49894110 mov qword ptr [r9+10h],rax ---> update the value of this+10h
00007ffd`6164f03d 498d46ff lea rax,[r14-1]
Because the loop is executed too many times, finally the value of this+10h points to an invalid memory address and it causes an out-of-bound access in heap memory. The crash location is as follows:
NBDoc!CDecbp::Decode+0xec:
00007ffd`6164ec9c 488b4f10 mov rcx,qword ptr [rdi+10h]
00007ffd`6164eca0 c7472808000000 mov dword ptr [rdi+28h],8
00007ffd`6164eca7 0fb601 movzx eax,byte ptr [rcx] --->crash here
00007ffd`6164ecaa 894724 mov dword ptr [rdi+24h],eax
00007ffd`6164ecad 488d4101 lea rax,[rcx+1]
00007ffd`6164ecb1 48894710 mov qword ptr [rdi+10h],rax
00007ffd`6164ecb5 ff4f28 dec dword ptr [rdi+28h]
00007ffd`6164ecb8 48634f28 movsxd rcx,dword ptr [rdi+28h]
(3488.3858): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
NBDoc!CDecbp::Decode+0xf7:
00007ffd`6164eca7 0fb601 movzx eax,byte ptr [rcx] ds:00000060`ec9b9000=??
0:000> r
rax=0000000000000003 rbx=0000000000000000 rcx=00000060ec9b9000
rdx=0000000000000000 rsi=0000000000004000 rdi=00000060dc7ed3a0
rip=00007ffd6164eca7 rsp=00000060dc7ed240 rbp=00000060ec9ecfc0
r8=00000060ec9e8f80 r9=0000000000930006 r10=00000060ec9ecfc0
r11=0000000000000000 r12=00000000ffffffee r13=000000000000003d
r14=00000060ec9e8f80 r15=0000000000000017
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
NBDoc!CDecbp::Decode+0xf7:
00007ffd`6164eca7 0fb601 movzx eax,byte ptr [rcx] ds:00000060`ec9b9000=??
0:000> dp rdi
00000060`dc7ed3a0 00930006`00000002 00000000`0000003d
00000060`dc7ed3b0 00000060`ec9b9000 00000000`000000a2 //rcx is [rdi+10h], 00000060`ec9b9000 points to an invalid heap memory address
00000060`dc7ed3c0 00000000`00000580 00007f01`00000008
00000060`dc7ed3d0 00000060`00000003 00000008`00000002
00000060`dc7ed3e0 00000000`00000000 00000000`00000000
00000060`dc7ed3f0 ffffffff`fffffffe 00000060`ec9eaf80
00000060`dc7ed400 00000060`ec9e6fd0 00000060`ec9e2fc0
00000060`dc7ed410 00000060`ec9e8f80 00000060`ec9e4fd0
0:000> kb
# RetAddr : Args to Child : Call Site
00 00007ffd`6164597e : 00000060`00000000 00000060`ec9eaf80 00000000`00930006 00000060`dc7ed2f0 : NBDoc!CDecbp::Decode+0xf7
01 00007ffd`616454b9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000060`ec9c8fc0 : NBDoc!DecodePos+0x2c6
02 00007ffd`6164ca28 : 00000060`e1351750 00000060`dc7ee7c0 00000060`e1351750 00000060`ec9c4fe0 : NBDoc!CBLCDecode::DecodeWithClusters+0x73d
03 00007ffd`61691873 : 00000000`000005a5 00000000`000005a5 00000000`0000072a 00000060`ec9c4fe0 : NBDoc!CBLCDecode::Decode+0xb8
04 00007ffd`616a1e41 : 00000060`ec9b8e00 00000060`ec9bafa0 00000000`000001fc 00000000`00000060 : NBDoc!DecodeBlcToCanvas+0x213
05 00007ffd`616a2465 : 00ffffff`00000000 00000060`ec9bafa0 00000060`dc7eea00 00000060`00000000 : NBDoc!CEPMRCFormatReader::LoadBLCToCanvas+0xd1
06 00007ffd`61693c95 : 00000000`00000000 00000060`ec8c7fd0 00000000`00000000 00000060`e1021ff0 : NBDoc!CEPMRCFormatReader::RgnsToImageLayers+0x225
07 00007ffd`61692af8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000060`e0fbbf68 : NBDoc!CIFD::GetMRCImages+0x375
08 00007ffd`61692680 : 00000060`dc7eede8 00000060`e0e49e10 00000000`0000270f 00007ffd`616265e2 : NBDoc!CIFD::GetCompositeLayer+0x218
09 00007ffd`6162aeb7 : 00000000`00000001 00000060`dc7eed90 00000000`00000000 00000060`e1093f40 : NBDoc!CIFD::GetImageLayerEx+0xf0
0a 00007ffd`6162acbc : 00000060`00000001 00000060`e1093f40 00000060`ec8b1f98 00000060`00000001 : NBDoc!CEPEditablePageTiffImpl::InternalGetImageLayer+0x1bf
0b 00007ffd`63f3b48c : 00000060`00000000 00000060`e1093f40 00007ffd`615b6f20 00000060`00000000 : NBDoc!CEPEditablePageTiffImpl::GetImageLayer+0x7c
0c 00007ffd`63f4773e : 00000060`00000000 00007ffd`63f45310 00000060`e1093f40 00000060`ec8b1f40 : MSPVWCTL!CPage::EnableImageLayer+0x100
0d 00007ffd`63f34c16 : 00007ffd`63f47270 00000060`00000000 00000060`dc7eef80 00000000`00000001 : MSPVWCTL!CPageDisplay::SetPageNum+0xe6
0e 00007ffd`63f361ba : 00000000`00000001 00007ffd`63f4acd0 00000060`00000000 00000060`00000000 : MSPVWCTL!CMultiPageDisplayViewBase::AddPageD+0x1ca
0f 00007ffd`63f4207b : 00007ffd`63f7eba8 00007ffd`63f42040 00000000`00000003 00000060`eda366e0 : MSPVWCTL!CDocViewBaseImpl::UpdateViewLayout+0x3ba
10 00007ffd`63f3553c : 00000060`eda36601 00007ffd`63f40b00 00000000`00000011 000001b5`000003dc : MSPVWCTL!CDocMarkupView::UpdateViewLayout+0x3b
11 00007ffd`63f409e6 : 00007ffd`63f3c8a0 00000060`dc7ef290 00000000`00000000 00007ffd`63f7e778 : MSPVWCTL!CDocViewBaseImpl::Recalc+0x4c
12 00007ffd`63f408c4 : 00000000`00000000 00000000`00000009 00000060`eda366f0 00007ffd`00000000 : MSPVWCTL!CDocReadingViewBase::MoveToSubpage+0xf6
13 00007ffd`63f4283b : 00000000`00000000 00000060`dc7ef380 00007ffd`63f42460 00000060`eda366e0 : MSPVWCTL!CDocReadingViewBase::OnVScroll+0xb4
14 00007ffd`63f424ac : 00000000`0000ff88 00000060`e06a38f0 00007ffd`63f42460 00000060`eda36700 : MSPVWCTL!CDocMarkupView::OnVScroll+0x2bb
15 00007ffd`63f1ae50 : 00000000`00000000 ffffffff`00000000 ffffffff`ff880000 ffffffff`ff880000 : MSPVWCTL!CDocMarkupView::OnMouseWheel+0x4c
16 00007ffd`63f2826d : 00000000`0000020a 00000060`dc7ef4c0 00000000`00000001 ffffffff`ff880000 : MSPVWCTL!CEPDocView::OnMouseWheel+0xa0
17 00007ffd`63f2cbe4 : 00007ffd`63f27ed0 00000000`00080acc 00000000`00080acc 00000000`00000000 : MSPVWCTL!CEPDocView::ProcessWindowMessage+0x39d
18 00007ffd`84d100dc : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : MSPVWCTL!ATL::CWindowImplBaseT<CEPDocViewWindow,ATL::CWinTraits<1442840576,0> >::WindowProc+0x84
19 00007ffd`84d0fc07 : 00000060`e17e4480 00007ffd`80181080 00000000`00080acc 00007ff7`c9dcc800 : USER32!UserCallWinProcCheckWow+0x1fc
1a 00007ffd`636fa79a : 00007ff7`cab89410 00007ff7`cab89410 00000000`00000000 00000000`00000000 : USER32!DispatchMessageWorker+0x1a7
1b 00007ffd`636facc8 : 00007ff7`cab1afd0 00007ff7`cab89410 00000000`00000000 00007ff7`caa75ebc : MFC42u!CWinThread::PumpMessage+0x6a
1c 00007ffd`636f28ed : 00007ff7`cab1afc0 00007ff7`caa60000 00000000`00000000 00000060`de08ef7e : MFC42u!CWinThread::Run+0x88
1d 00007ff7`cab1bc26 : 00007ff7`cab26218 00000000`00000000 00000000`0000001f 00000000`00000001 : MFC42u!AfxWinMain+0xad
1e 00007ffd`83172d92 : 00007ff7`cab1bcd0 00007ff7`c9dce000 00007ff7`c9dce000 00000000`00000000 : Journal!CWnd::GetRuntimeClass+0x316
1f 00007ffd`850a9f64 : 00007ffd`83172d70 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x22
20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34
0:000> !heap -p -a rcx
address 00000060ec9b9000 found in
_DPH_HEAP_ROOT @ 60e03f1000
in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize)
60f825ddd0: 60ec9b8e00 1fc - 60ec9b8000 2000
00007ffd8518ba7b ntdll!RtlDebugAllocateHeap+0x0000000000000047
00007ffd85146292 ntdll!RtlpAllocateHeap+0x00000000000757b2
00007ffd850ceed2 ntdll!RtlpAllocateHeapInternal+0x0000000000000292
00007ffd83309c30 msvcrt!malloc+0x0000000000000070
00007ffd616c6db3 NBDoc!operator new+0x0000000000000023
00007ffd616a238d NBDoc!CEPMRCFormatReader::RgnsToImageLayers+0x000000000000014d
00007ffd61693c95 NBDoc!CIFD::GetMRCImages+0x0000000000000375
00007ffd61692af8 NBDoc!CIFD::GetCompositeLayer+0x0000000000000218
00007ffd61692680 NBDoc!CIFD::GetImageLayerEx+0x00000000000000f0
00007ffd6162aeb7 NBDoc!CEPEditablePageTiffImpl::InternalGetImageLayer+0x00000000000001bf
00007ffd6162acbc NBDoc!CEPEditablePageTiffImpl::GetImageLayer+0x000000000000007c
00007ffd63f3b48c MSPVWCTL!CPage::EnableImageLayer+0x0000000000000100
00007ffd63f4773e MSPVWCTL!CPageDisplay::SetPageNum+0x00000000000000e6
00007ffd63f34c16 MSPVWCTL!CMultiPageDisplayViewBase::AddPageD+0x00000000000001ca
00007ffd63f361ba MSPVWCTL!CDocViewBaseImpl::UpdateViewLayout+0x00000000000003ba
00007ffd63f4207b MSPVWCTL!CDocMarkupView::UpdateViewLayout+0x000000000000003b
00007ffd63f3553c MSPVWCTL!CDocViewBaseImpl::Recalc+0x000000000000004c
00007ffd63f409e6 MSPVWCTL!CDocReadingViewBase::MoveToSubpage+0x00000000000000f6
00007ffd63f408c4 MSPVWCTL!CDocReadingViewBase::OnVScroll+0x00000000000000b4
00007ffd63f4283b MSPVWCTL!CDocMarkupView::OnVScroll+0x00000000000002bb
00007ffd63f424ac MSPVWCTL!CDocMarkupView::OnMouseWheel+0x000000000000004c
00007ffd63f1ae50 MSPVWCTL!CEPDocView::OnMouseWheel+0x00000000000000a0
00007ffd63f2826d MSPVWCTL!CEPDocView::ProcessWindowMessage+0x000000000000039d
00007ffd63f2cbe4 MSPVWCTL!ATL::CWindowImplBaseT<CEPDocViewWindow,ATL::CWinTraits<1442840576,0> >::WindowProc+0x0000000000000084
00007ffd84d100dc USER32!UserCallWinProcCheckWow+0x00000000000001fc
00007ffd84d0fc07 USER32!DispatchMessageWorker+0x00000000000001a7
00007ffd636fa79a MFC42u!CWinThread::PumpMessage+0x000000000000006a
00007ffd636facc8 MFC42u!CWinThread::Run+0x0000000000000088
00007ffd636f28ed MFC42u!AfxWinMain+0x00000000000000ad
00007ff7cab1bc26 Journal!CWnd::GetRuntimeClass+0x0000000000000316
00007ffd83172d92 KERNEL32!BaseThreadInitThunk+0x0000000000000022
00007ffd850a9f64 ntdll!RtlUserThreadStart+0x0000000000000034
0:000> db 60ec9b8e00 L1fc+16
00000060`ec9b8e00 02 00 00 00 00 00 00 ff-ff ff 96 00 42 4c 43 54 ............BLCT
00000060`ec9b8e10 20 00 2a 07 00 00 a5 05-00 00 96 00 98 00 d5 db .*.............
00000060`ec9b8e20 3c a5 79 55 49 40 9f 26-f8 53 24 85 f6 8f 57 00 <.yUI@.&.S$...W.
00000060`ec9b8e30 00 00 00 00 00 00 05 00-00 00 44 00 00 00 58 00 ..........D...X.
00000060`ec9b8e40 00 00 bb 00 00 00 09 01-00 00 12 01 00 00 42 49 ..............BI
00000060`ec9b8e50 54 56 08 00 00 00 3d 00-00 00 00 00 00 00 00 00 TV....=.........
00000060`ec9b8e60 00 00 50 54 52 53 5b 00-00 00 3d 00 00 00 00 3d ..PTRS[...=....=
00000060`ec9b8e70 00 00 00 4e 00 00 00 00-30 d0 03 89 00 00 00 08 ...N....0.......
00000060`ec9b8e80 00 00 00 0a 00 00 00 66-79 28 2a 5f 2c 28 73 28 .......fy(*_,(s(
00000060`ec9b8e90 1b 27 6b 27 32 1e 1b 28-fa fa fa 24 24 fb fb fb .'k'2..(...$$...
00000060`ec9b8ea0 72 0f 72 6a 6a 8c 18 55-6a 80 6a 72 0a 1c 6a 8c r.rjj..Uj.jr..j.
00000060`ec9b8eb0 55 72 6a 6e 72 70 00 38-55 72 0b 0d 15 15 14 0d Urjnrp.8Ur......
00000060`ec9b8ec0 6a 8c 55 72 00 52 45 53-49 46 00 00 00 96 00 42 j.Ur.RESIF.....B
00000060`ec9b8ed0 4c 43 52 20 00 2a 07 00-00 a5 05 00 00 a0 a0 a0 LCR .*..........
00000060`ec9b8ee0 a0 a0 a0 a0 a0 a0 a0 a0-a0 a0 a0 a0 a0 a0 a0 a0 ................
00000060`ec9b8ef0 a0 a0 a0 a0 a0 a0 a0 a0-a0 7f ff ff ff ff f8 7f ................
00000060`ec9b8f00 ff ff ff ff ff ff ff ff-c0 00 00 22 ba 80 52 04 ..........."..R.
00000060`ec9b8f10 00 a0 a0 50 41 47 45 01-00 00 00 00 50 4f 53 49 ...PAGE.....POSI
00000060`ec9b8f20 d8 00 00 00 04 00 2a 00-3d 00 00 00 13 00 00 00 ......*.=.......
00000060`ec9b8f30 3d 00 00 00 81 00 0f f1-06 11 d8 00 14 00 6e 00 =.............n.
00000060`ec9b8f40 42 50 47 52 02 00 00 00-06 00 93 00 3d 00 00 00 BPGR........=...
00000060`ec9b8f50 06 09 20 08 53 a9 45 2d-02 12 60 08 00 60 0a 24 .. .S.E-..`..`.$
00000060`ec9b8f60 42 a4 82 d5 12 b5 50 85-c8 00 05 28 4a 82 e8 00 B.....P....(J...
00000060`ec9b8f70 43 05 38 36 87 29 00 14-00 6e 00 42 50 47 52 02 C.86.)...n.BPGR.
00000060`ec9b8f80 00 00 00 03 00 00 00 3d-00 00 00 03 41 ed 80 f5 .......=....A...
00000060`ec9b8f90 4a aa a0 00 a1 bf 36 c1-1b 21 0a 84 22 40 14 00 J.....6..!.."@..
00000060`ec9b8fa0 6e 00 42 50 47 52 02 00-00 00 0b 00 00 00 12 00 n.BPGR..........
00000060`ec9b8fb0 00 00 0b 54 4b 00 00 02-40 62 e9 60 db d3 55 00 ...TK...@b.`..U.
00000060`ec9b8fc0 74 71 80 d6 14 00 07 ef-c0 d0 96 80 8a ef 40 2c tq............@,
00000060`ec9b8fd0 74 c0 14 00 6e 00 42 50-47 52 02 00 00 00 0b 00 t...n.BPGR......
00000060`ec9b8fe0 00 00 12 00 00 00 0b 80-00 00 80 80 80 a6 90 84 ................
00000060`ec9b8ff0 ff 10 00 60 00 82 00 bd-00 89 4f c0 d0 d0 d0 d0 ...`......O.....
00000060`ec9b9000 ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ?? ????????????????
00000060`ec9b9010 ?? ?? ??
From the above, 00000060`ec9b9000 points to an invalid heap memory address and causes a heap overflow. It could lead to arbitrary code execution.
Special thanks to Kai Liu of FortiGuard Labs, who discovered this vulnerability.
And now, for your weekend bonus:
Back in July, we disclosed a QuickTime heap overflow vulnerability, also discovered by FortiGuard Labs. We discovered another such vulnerability that was patched by Apple in August, so for a weekend treat, here's our take. Yes, August is a long time ago in security-land, but it's timely as rich media comes under increasing scrutiny as an attack vector.
Specifically, FortiGuard Labs discovered a memory corruption vulnerability in QuickTime. This vulnerability is caused due to insufficient validation of the value of ‘sample_size’ field when parsing the ‘stsz’ atom. It may lead to an unexpected application termination or arbitrary code execution.A memory corruption vulnerability has been discovered in QuickTime. This vulnerability is caused due to insufficient validation of the value of ‘sample_size’ field when parsing ‘stsz’ atom. It may lead to an unexpected application termination or arbitrary code execution.
We use 010 Editor to parse the structure of the 3gp file. FG-VD-15-040_original.3gp is the original good 3gp file. FG-VD-15-040_PoC.3gp is the crafted 3gp file. From following screen shots, you can see the difference between the two:
Figure 1. Structure of FG-VD-15-040_original.3gp
Figure 2. Structure of FG-VD-15-040_PoC.3gp
The ‘stsz’ atom specifies the size of each sample in a sample table. The definition of its structure is shown below:
Figure 3. Definition of ‘stsz’ Structure
The value of the ‘SampleSize’ field in atom 'stsz' should be 0x00000000. When we modify it to a very large value (e.g. 0x0000F200), this vulnerability can be triggered.
Again, thanks to Kai Liu of FortiGuard Labs for discovering this vulnerability.
