[Bkis-07-2009] 010 Editor Multiple Buffer Overflow Vulnerabilities

[Bkis <svrt@xxxxxxxxxxx>]

010 Editor Multiple Buffer Overflow Vulnerabilities

1. General Information

010 Editor is a text editor and hex editor, with a lot of functions as 
view and edit binary files, analyze and edit binary data, import and 
export binary data in many different formats.

Bkis has just found many vulnerabilities in the software, related to the 
processing of 010 Editor Binary Template files (“.bt”) and 010 Editor 
Script Files (“.1sc”). These vulnerabilities are very dangerous due to 
the fact that they allow hackers to execute malicious code on users’ 
systems.

We’ve reported to the vendor about the errors and they’ve released a 
fixed version. All related information can be reached at: 
http://www.sweetscape.com/010editor/release_notes.html

Details : http://security.bkis.vn/?p=580
Bkis Advisory : Bkis-07-2009
Initial vendor notification : 03/04/2009
Release Date : 04/22/2009
Update Date : 04/22/2009
Discovered by : Le Duc Anh - Bkis
Attack Type : Buffer Overflow
Security Rating : Critical
Impact : Code Execution
Affected Software : 010 Editor Version <= 3.0.4
PoC : 
http://security.bkis.vn/wp-content/uploads/2009/04/010editor_v304_poc.zip

2. Technical Description

Binary Template and Script files are advertised as highlighted features 
of 010 Editor. Binary Template files help users parse and edit many 
types of binary files and Script files let users perform automatic 
tasks. The software has not handled these file formats well enough 
resulting in a lot of serious vulnerabilities.

Many fields in those two file formats might create buffer overflow 
errors when set with an overly long value. More precisely, errors can 
occur in the handling of the following fields and elements:
• Struct name in “.bt” files
• Custom attributes in “.bt” files
• Number format (a number prefixed by “0x”, or something else) in both 
“.bt” and “.1sc” files
• Mathematics operators in both “.bt” and “.1sc” files
• Function name in “.1sc” files
• Function parameters in “.1sc” files

In order to exploit, a hacker might create a specially crafted “.bt” or 
“.1sc” file and trick users into using it. If successful, hackers can 
perform local attack, inject viruses, steal sensitive information and 
even take control of the victim’s system.

3. Solution

The producer has fixed the vulnerability in 010 Editor Version 3.0.5. 
Rating this vulnerability high severity, Bkis recommends that users 
should update their software to the latest version.