Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-4088

[Rodrigo Branco <rbranco@xxxxxxxxxxxxxx>]

Dear List,

I'm writing on behalf of the Check Point Vulnerability Discovery Team to 
publish the following vulnerability.


Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/

Memory corruption when Adobe Shockwave Player parses .dir media file 
(duplicated KEY* reference in mmap record)
CVE-2010-4088


INTRODUCTION

Adobe Shockwave Player is the Adobe plugin to many different browsers to view 
rich-media content on the web including animations, interactive 
presentations, and online entertainment.

Adobe Shockwave Player does not properly parse .dir media file.  mmap records 
contains offsets and lengths of all other records.  One of such records is 
KEY*. It also contains references to other records. Duplicated references to 
the same KEY* chunk causes problems in Chrome.

This problem was confirmed in the following versions of Adobe Shockwave Player 
and Windows, other versions may be also affected.

Shockwave Player version 11.5.8.612, Module DIRAPI.dll on WinXP_PT SP3 Google 
Chrome 6.0.472.55


CVSS Scoring System

The CVSS score is: 9
        Base Score: 10
        Temporal Score: 9
We used the following values to calculate the scores:
        Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C
        Temporal score is: E:POC/RL:U/RC:C


TRIGGERING THE PROBLEM

To trigger the problem a PoC file (repro14.dir) is available to interested 
parties. 


DETAILS


Due to the very nature of the problem and the way the browser handles it 
internally, it is very difficult to debug.  The browser catches the
failure.

ModLoad: 041c0000 041c7000   
C:\WINDOWS\system32\Adobe\SHOCKW~1\xtras\CBrowser.x32
(924.a78): Break instruction exception - code 80000003 (first chance)
eax=7ffdd000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c90120e esp=312fffcc ebp=312ffff4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
7c90120e cc              int     3

After the break point hit, we see the browser just handles the crash of the 
plugin:

0:009> g
eax=7ffdd000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c90120f esp=312fffcc ebp=312ffff4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
ntdll!DbgBreakPoint+0x1:
7c90120f c3              ret
0:009> k
ChildEBP RetAddr  
312fffc8 7c951e40 ntdll!DbgBreakPoint+0x1
312ffff4 00000000 ntdll!DbgUiRemoteBreakin+0x2d


Forcing the browser to run in single-mode process we have:

ModLoad: 041c0000 041c7000   
C:\WINDOWS\system32\Adobe\SHOCKW~1\xtras\CBrowser.x32
ModLoad: 77920000 77a13000   C:\WINDOWS\system32\SETUPAPI.dll
eax=00000001 ebx=7c802446 ecx=00000000 edx=00000000 esi=0073abc0 edi=000009e0
eip=7c90e460 esp=042cff08 ebp=042cff50 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntdll!KiUserCallbackDispatcher:
7c90e460 83c404          add     esp,4
7c90e463 5a              pop     edx
7c90e464 64a118000000    mov     eax,dword ptr fs:[<Unloaded_papi.dll>+0x7 
(00000018)]
7c90e46a 8b4030          mov     eax,dword ptr [eax+30h]
7c90e46d 8b402c          mov     eax,dword ptr [eax+2Ch]
7c90e470 ff1490          call    dword ptr [eax+edx*4]
7c90e473 33c9            xor     ecx,ecx
7c90e475 33d2            xor     edx,edx
7c90e477 cd2b            int     2Bh
7c90e479 cc              int     3

The Stack Trace:
ntdll!KiUserCallbackDispatcher+0x0
USER32!NtUserMessageCall+0xc
USER32!SendMessageA+0x7f
Plugin!NP_Shutdown+0x41f4



CREDITS

This vulnerability was discovered by Michael Golub and researched by Rodrigo 
Rubira Branco from Check Point Vulnerability Discovery Team (VDT).



Best Regards,
 
Rodrigo.
 
--
Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies