Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-4087

[Rodrigo Branco <rbranco@xxxxxxxxxxxxxx>]

Dear List,

I'm writing on behalf of the Check Point Vulnerability Discovery Team to 
publish the following vulnerability.


Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/

Memory corruption when Adobe Shockwave Player parses .dir media file (mmap 
record - VSWV entry)
CVE-2010-4087


INTRODUCTION

Adobe Shockwave Player is the Adobe plugin to many different browsers to view 
rich-media content on the web including animations, interactive presentations, 
and online entertainment.

Adobe Shockwave Player does not properly parse .dir media file, which causes a 
corruption in module IML32.dll by opening a malformed file with an invalid 
length of VSWV entry inside a mmap record.

This problem was confirmed in the following versions of Adobe Shockwave Player 
and Windows, other versions may be also affected.

Shockwave Player version 11.5.8.612, Module IML32.dll on WinXP_PT SP3 Internet 
Explorer 8.0.6001.18702


CVSS Scoring System

The CVSS score is: 9
        Base Score: 10
        Temporal Score: 9
We used the following values to calculate the scores:
        Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C
        Temporal score is: E:POC/RL:U/RC:C


TRIGGERING THE PROBLEM

To trigger the problem a PoC file (repro13.dir) is available to interested 
parties. 


DETAILS

0:008> r
eax=0487d294 ebx=04830028 ecx=362607f0 edx=04930014 esi=0488dbf0 edi=0488d9e0
eip=69081264 esp=0162be10 ebp=00000210 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
IML32!Ordinal2064+0x7254:
69081264 894c31fc        mov     dword ptr [ecx+esi-4],ecx 
ds:0023:3aaee3dc=????????
0:008> !exploitable
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at 
IML32!Ordinal2064+0x0000000000007254 (Hash=0x3e3c3a38.0x484c154e)

User mode write access violations that are not near NULL are exploitable.


Disassembly:

0:008> u 0x69081264 L15
IML32!Ordinal2064+0x7254:
69081264 894c31fc        mov     dword ptr [ecx+esi-4],ecx
69081268 83c902          or      ecx,2
6908126b 890e            mov     dword ptr [esi],ecx
6908126d 8b4318          mov     eax,dword ptr [ebx+18h]
69081270 894608          mov     dword ptr [esi+8],eax
69081273 8b4804          mov     ecx,dword ptr [eax+4]
69081276 894e04          mov     dword ptr [esi+4],ecx
69081279 8b5004          mov     edx,dword ptr [eax+4]
6908127c 897208          mov     dword ptr [edx+8],esi
6908127f 8b54241c        mov     edx,dword ptr [esp+1Ch]
69081283 897004          mov     dword ptr [eax+4],esi
69081286 eb1e            jmp     IML32!Ordinal2064+0x7296 (690812a6)
69081288 8d3c31          lea     edi,[ecx+esi]
6908128b 894ffc          mov     dword ptr [edi-4],ecx
6908128e 83c902          or      ecx,2
69081291 890e            mov     dword ptr [esi],ecx
69081293 8b042f          mov     eax,dword ptr [edi+ebp]
69081296 8b7604          mov     esi,dword ptr [esi+4]
69081299 83c802          or      eax,2
6908129c 89042f          mov     dword ptr [edi+ebp],eax
6908129f 8bc5            mov     eax,ebp


CREDITS

This vulnerability was discovered by Michael Golub and researched by Rodrigo 
Rubira Branco from Check Point Vulnerability Discovery Team (VDT).



Best Regards,
 
Rodrigo.
 
--
Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies